#391 ci(release): gate cuts on built-dist smoke

[hachej]

Summary

• add a release-candidate workflow that builds package/plugin dist artifacts and boots the workspace playground in dist-only mode
• prove the application’s real public Agent stylesheet loads as text/css with production-scale bytes and one Alpha first-send completes
• reject any package/plugin source fallback across resolve/load/transform hooks
• gate release cuts on exact-SHA RC and full-CI aggregate checks with 45-minute polling headroom
• revalidate and atomically assert main while publishing the annotated release tag, then create the GitHub release from that verified tag
• make pre-tag and post-tag/pre-release failures safely resumable

Proof

• release-control tests: 20/20
• workspace-playground tests: 18/18
• workspace-playground typecheck
• positive built-dist golden route: green; Agent CSS text/css, 168,771 bytes; exactly one first send
• expected-red proofs: small CSS, wrong MIME, broken first-send
• action pins, shell/Node syntax, and diff checks
• independent acceptance review: CLEAN
• thermo validation confirmed atomic main/tag rejection when main advances; final local-tag cleanup uses compare-and-delete by exact tag-object SHA

Release safety

• release candidate label changes now reroute full CI
• Node version matches publishing (24)
• latest exact-name GitHub Actions check for the exact SHA wins; older reruns cannot satisfy the gate
• atomic push uses an exact main lease, so a stale SHA creates neither remote tag nor release
• concurrent same-target local tag replacement is retained because cleanup uses git update-ref -d <ref> <created-object-sha>
• resume rejects one-sided/mismatched tags or an existing GitHub release

Scope note

This gate validates built dist from the exact release SHA before the GitHub release. Publishing still rebuilds from that same tagged SHA; exact tarball reuse is a later optional redesign, not required for this exit item.