[CI/CD] Gate every release on the exact commit that passed CI

[fettpl]

Summary

Make release publication a downstream job of the same CI workflow and commit that passed every configured gate. The reusable release workflow checks out the tested SHA explicitly, fetches authoritative origin/main immediately before publication, and proceeds only when the tested SHA, checked-out HEAD, and current remote main are identical.

Release concurrency retains every validated pending revision with queue: max. This prevents an older, slower gate completion from replacing the newer pending tip; stale revisions remain queued only long enough to fail the remote-main guard without publishing.

Closes #220

Review exact commit 3cdd3a6402308c1d7a25816205cdedd7e73688f6.

Root cause

The audited release workflow reacted independently to main pushes, so semantic-release could start before validation for that SHA completed. Simple non-cancelling concurrency was also insufficient: GitHub's default concurrency retains only one pending run, allowing a third run to replace the current pending tip.

Current main additionally required controller dependencies for contract validation, and its redundant direct playwright declaration failed dependency cleanup.

Solution design

• Converts release.yml to a reusable workflow_call workflow.
• Calls release only on main pushes after gates, controller, and frontend succeed.
• Checks out ${{ github.sha }} and rejects publication unless tested SHA = HEAD = freshly fetched origin/main.
• Uses cancel-in-progress: false with queue: max so validated release candidates remain FIFO instead of replacing the pending tip.
• Defaults workflows to read-only contents and scopes release writes to the release job.
• Preserves single-flight publication without canceling an in-progress release.
• Installs controller dependencies before contracts and removes the redundant direct Playwright dependency.

Acceptance evidence

• Pull-request events cannot satisfy the release job condition.
• Release depends on every configured validation job for the same workflow SHA.
• A real git fixture reports current only for tested SHA = checked-out SHA = remote main; older or mismatched revisions fail closed.
• The regression suite covers newer B pending behind running X while slower stale A enters third: queue order remains X, B, A; B publishes and A skips.
• Validation jobs remain read-only; only the release job receives contents/issues/pull-request writes.
• Current GitHub workflow schema accepts concurrency.queue: max; the repository test asserts the exact concurrency contract.

Validation

• Rebasing onto origin/main at 08bcba27f137f9c3d0206ea811d0aa7548a2dfa6 completed with the branch zero commits behind main.
• Release workflow tests: 3/3 passed.
• Current GitHub workflow schema validation: ci.yml and release.yml passed.
• npm ci --legacy-peer-deps in frontend: passed with 0 vulnerabilities.
• bun install --frozen-lockfile in controller: passed.
• npm --prefix frontend run check:quality: passed.
• npm run check: passed.
• git diff --check: passed.
• npm --prefix frontend run desktop:dist: passed.
• The packaged app was copied without extended attributes, ad-hoc signed with the repository runtime entitlements, and passed strict deep signature verification.
• The canonical /Applications/Local Studio.app install reported bundle ID org.local.studio.desktop, launched successfully, and returned HTTP 200 from /api/desktop-health.
• Independent P0/P1 review approved exact SHA 3cdd3a6402308c1d7a25816205cdedd7e73688f6.

The exact main revision has no frontend test or root test:integration script, so both required command invocations were recorded as unavailable rather than represented as passing.

UI changes

None.

Risks / rollout notes

• GitHub Actions must use its current workflow schema; the published legacy @action-validator/cli@0.6.0 embeds a 2024 schema and falsely rejects the officially supported queue field.
• Repository Actions still require a maintainer to approve runs from this fork.
• A stale queued release completes without publication after the authoritative-main check; the current tip remains queued and publishes in FIFO order.

[fettpl]

@0xSero PR #244 is the independently approved foundation for the P1 audit PR wave. Exact rebased head 3cdd3a6402308c1d7a25816205cdedd7e73688f6 is ready/non-draft and mergeable; CI and Security are waiting only for upstream workflow approval: CI and Security. Please approve them when convenient. The branch is based on current main; focused release tests, repository gates, independent P0/P1 review, desktop packaging/reinstall, and /api/desktop-health all passed.