The first draft run exposed two ways the ae-add self-check lied. (1) A draft
release does not push its git tag until published, so `ae add @<tag>` cannot
resolve yet — the gate now skips drafts with a note telling you to verify after
publishing, instead of reporting a pass it did not earn. (2) `ae add` clones then
`git checkout <tag>` and can fall back to a cached/default checkout on a miss,
exiting 0 — so the gate now clears any stale package clone first and asserts the
resolved HEAD equals the built commit, not merely that ae add exited 0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N1Vjg3yn7uc7uMXNmyJz1e