Gate release publication on canonical tag policy

[omkhar]

Summary

• fail unsupported tags in the first read-only release job and before publisher API access
• distinguish final and release-candidate create/publish metadata
• add dynamic all-job gating, payload negative controls, workflow-lane parity, and scoped runbook updates

Validation

• ./scripts/pre-merge.sh --profile pr-parity (exact signed commit)
• go test -race ./internal/host/release ./cmd/workcell-hostutil
• ./scripts/check-workflows.sh
• ./scripts/verify-workflow-lanes.sh
• tests/scenarios/shared/test-publish-github-release.sh
• three-lens peer-review loop clean

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 16b399be15

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".