The gate job decides whether to cut a stable mirror tag by querying the
triggering workflow_run's jobs for a successful "Semantic Release" job.
Every non-hotfix PR merge produces a Hotfix Release run that is skipped in
its entirety, and the jobs API returns an EMPTY job list for such runs -
not a list carrying a skipped conclusion. That empty list hit the gate's
"" (job-absent) branch, which fails OPEN, so the sync proceeded and tagged
whatever pending component version sat on master as a stable mirror
release. This cut three accidental stable tags on ha-mcp-integration:
v1.1.1, v1.2.0, and v1.2.1.

Short-circuit on github.event.workflow_run.conclusion == "skipped" before
the jobs query: a run skipped in its entirety performed no release, so no
stable tag is due. Fail-open remains deliberate for runs that actually
executed - a genuine API error or a truly absent "Semantic Release" job
(the job-name coupling breaking) still degrades to tagging, since a
suppressed tag strands HACS on an old component version.

Co-authored-by: kingpanther13 <kingpanther13@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>