ci: name each vendor stage for what it actually does

[thecodedrift]

#333 is titled "chore(vale): pin Vale 3.21.0", which is the one thing that PR does not do.

The problem

With both Vale stages now automated, the two PRs differed only in the word pin — and it was on the wrong one:

PR	Title before	What it actually does
#333	chore(vale): pin Vale 3.21.0	updates the manifest, republishes @taskless/vale-*. Changes no install.
(next)	chore(vale): upgrade to Vale 3.21.0	moves the pins a user resolves. Ships it.

release-vale.yml's own body already says "nothing reaches a consumer until that pin is deliberately bumped" — so the title claiming to be that bump contradicted the body two paragraphs below it.

After

chore(vale): accept upstream Vale 3.21.0       republish, changes no install
chore(vale): upgrade to Vale 3.21.0            moves the pins, ships it
chore(ast-grep): upgrade to ast-grep 0.45.3    moves the pins, ships it

One verb per operation, so a title says which stage you are looking at.

ast-grep moves to "upgrade to" as well. It was titled "pin ast-grep", which is accurate in isolation but read as a third kind of change next to the other two. It is the same operation as the Vale upgrade and now says so. ast-grep has no "accept upstream" counterpart because nothing here repackages it — that asymmetry is real and is noted in the workflow.

The republish body also now points at the stage that does reach a consumer, so a reviewer weighing digests knows this is not that one.

Scope

Titles, commit messages, and the comments explaining them. No behaviour change — vendor-pr.cjs passes whatever title it is given, and both workflow shells were re-syntax-checked. 432 script tests and lint pass.

Open PRs #333 and #334 are retitled in place to match, so nothing reads as the old scheme while this lands.