v2.24.1 — EMU warm-cache fix and pipeline simplification

Patch release.

Fixed

EMU account handles could pollute the warm-cache registry. dbUpsertUser and dbGetAllUserHandles now reject non-primary (EMU-shaped) handles via isValidHandle, so a malformed EMU source handle can no longer be retried forever by the hourly warm-cache cron for an account the server token can never resolve. (#1199)

Push-guard hooks false-positived on compound commands. The --tags and direct-to-main guards scanned the entire compound command string, so a benign git pull origin main && git push origin develop tripped the direct-to-main guard. Each git push invocation's own argument span is now isolated before matching.

Changed — release pipeline

Shipped after a real release surfaced concrete friction rather than theoretical concerns:

• Six approval gates collapsed to two. Gate 1 covers version choice and full diff approval; Gate 2 authorizes the entire remainder of the pipeline once.
• Four of six manual release obligations removed from the critical path. migration.review was deleted as redundant — the required database.pending-migrations scenario already imports the real CI job result. rollback.readiness, profile.share-verification and locales.en-es became automated probes. oauth.github-real and profile.authenticated-badge are now non-required, since satisfying them means storing test-account credentials.
• Automatic main → develop back-merge. Squash-merging a release discards shared history, which made the next release PR conflict, which meant GitHub created no pull_request workflow run, which made a required migrations gate report a misleading "skipped". The divergence is now reconciled automatically at the moment it is introduced.

While automating the demotions, analyzeReleaseRun was found to enforce manual-obligation completeness unconditionally, ignoring the bundling scenario's required flag — so marking a scenario non-required would have been cosmetic and the release would still have blocked. Fixed, with tests proving a required bundle still blocks and a non-required one does not.

Added

scripts/recalculate-handles.ts — maintenance tool to force handles to be recomputed with current scoring code and have the corrected value persist. Dry-run by default.

No migrations in this release.