fix: block template.html rename bypass

[jatintakhtani2612]

Problem

PR #4681 renamed cards/template.html to cards/Lu-86.html instead of copying the template.

The existing validation checked the current file path, so after the rename it only saw cards/Lu-86.html and did not detect that cards/template.html had been renamed.

This allowed the protected template file to bypass the validation logic.

Root Cause

The validation workflow used the current PR file paths:

gh pr view --json files

For a rename, the current path becomes cards/Lu-86.html, while the previous path (cards/template.html) is not checked by the existing template guard.

Fix

Updated scripts/validate-card-pr.js to query the GitHub Pull Request Files API and inspect renamed files.

If a PR contains:

cards/template.html → cards/<username>.html

the validation now rejects the PR using the existing template-protection message.

Verification

• node --check scripts/validate-card-pr.js ✅
• git diff --check ✅
• Reproduced the original PR luciano's card #4681 rename:
  cards/template.html → cards/Lu-86.html
• Confirmed GitHub reports the change as a rename (R100).