The EXIT trap ran `rm -rf $WORK` while the shell was still inside $WORK. Removing your own
working directory leaves rm unable to unlink it — 'cannot remove .git: Directory not empty' —
and a failing EXIT trap sets the script's exit status. So vortos-audit-admin printed
'no content change' (correct, its contents were unchanged) and then exited 1, failing a
release for work it had completed successfully.

Cleanup now leaves the directory first and cannot fail the job. Verified against local bare
repos across create / no-change / no-change-plus-tag; the no-change path is the one that
was failing and now exits 0.

Split from c238f2bc847c72d00ae154fd38ccb1657949d6b8