chore(vale): pin Vale 3.21.0

[github-actions]

Upstream Vale is ahead of the version this repository packages.

This updates .github/scripts/vale-manifest.json to the new upstream
version and replaces every platform's SHA256 with the digest from
upstream's vale_<version>_checksums.txt.

Reviewing this is the trust boundary. Merging it authorizes the
publish phase to download those exact archives and package them; a
download that does not match a digest here aborts the run and
publishes nothing. Check the digests against upstream's checksums file
for the release before approving.

Merging this triggers the publish phase, which stamps every platform
package <valeVersion>-<yyyymmddhhmmss> and publishes the set. That
publish is inert on its own: @taskless/cli pins exact versions, so
nothing reaches a consumer until that pin is deliberately bumped.

[thecodedrift]

Superseded by #333, which proposes the identical manifest — same version, same six digests, verified byte-for-byte:

diff <(git show <this-branch>:.github/scripts/vale-manifest.json) \
     <(git show vendor/vale/republish:.github/scripts/vale-manifest.json)
# no output

This PR was opened by the scheduled detect on 2026-09-14, before #332 moved the republish proposal onto the rolling vendor/vale/republish branch. The only difference between the two is that this branch was cut from an older main, so it predates that tooling.

Closing this one and deleting vale/update-3.21.0; the branch scheme it uses no longer exists. Any digest review done here carries over to #333 unchanged, because they authorize the same bytes.

— AI Coding Agent