ci(release): mirror ci.yml's network hardening in the release gate, ship it as v4.17.1

[cdeust]

Why

v4.17.0 is tagged but published nothing. Run 30741657854 failed in the test job and blocked all five downstream publish jobs — no GitHub release, no PyPI upload, no .mcpb bundle exists for that tag.

The cause is a trigger asymmetry, not a flake:

# ci.yml:4-8
on:
  push:
    branches: [main]
  pull_request:

A tag push never reaches ci.yml. So every network-hardening pass CI absorbed since 2026-07-27 silently skipped release.yml, while both files kept running the same suite. The two jobs diverged with nothing to report it.

What that cost:

test_spell_alteration.py::test_recall_real_spell_by_name
  -> pg_recall.py:443
  -> reranker.py:109
  -> FlashRank: requests.get(..., stream=True)   # no timeout
  -> hang in sock.connect
  -> pytest-timeout kills the suite

HF_HUB_OFFLINE does not reach FlashRank's own fetch path, and reranker.py's except Exception cannot engage against a hang that never raises. The tree had just passed 20 green checks on #334.

What changed

Commit 1 — release.yml's test job mirrors ci.yml:103-115,142-195 one-for-one (cache + retried prefetch + offline run, per model):

• cache ~/.cache/flashrank, matching reranker_model.py:104-113's reranker_cache_dir() (which honours $XDG_CACHE_HOME);
• prefetch the reranker via ensure_reranker_loaded() asserting state == 'loaded' — a failed fetch fails the step instead of resurfacing later as first-stage-only recall scores (the 2026-07-10 FlashRank incident);
• harden the HF prefetch to 5 retries with backoff and drop continue-on-error — a blip must not leave the cache empty and cascade into a misleading test failure;
• run pytest under HF_HUB_OFFLINE / TRANSFORMERS_OFFLINE / CORTEX_RERANKER_OFFLINE, so no download can happen mid-suite.

ci.yml's three tree-sitter steps are deliberately NOT ported. requirements/release.txt omits tree-sitter and tree-sitter-language-pack (as it omits igraph, leidenalg, texttable), so the AST tests skip in this job and there is no grammar to fetch — porting them would have failed on ImportError. A comment records the corollary: this gate tests a narrower surface than CI, and the three steps must follow if release.txt ever gains that dependency.

Commit 2 — bump to v4.17.1. No source change; v4.17.1 carries v4.17.0's tree plus the workflow fix.

Why a new version rather than moving the tag

A tag executes the release.yml of its own tree. v4.17.0 points at 13278df4, which carries the unhardened file — a re-run would replay the same hang. Recreating the tag would rewrite a published ref and break the "tree bit-identical to ae633a87" property the v4.17.0 release decision rests on. House precedent: v3.15.2 abandoned → v3.15.3.

workflow_dispatch was not an option either: the publish jobs gate on event_name == 'push'.

Verification

• ensure_reranker_loaded() → state='loaded' in a local .venv;
• generate_repo_badges.py --check (4 badges), check_doc_claims.py, check_marketplace_pins.py — all exit 0;
• every touched JSON parses;
• actionlint is not installed on this machine, so workflow validation was limited to a YAML parse plus review. CI on this PR is the real check.

Follow-up (not in this PR)

The durable fix for the divergence is a shared workflow_call between ci.yml and release.yml. Set aside today in favour of alignment; issue to follow.

🤖 Generated with Claude Code