CI overhaul (7/9): make the exact package candidate the sole push-to-main gate #74

Part of the CI overhaul execution plan (#59, map #53). Order: 7 of 9 — blocked by 1/9 (#65, iOS 26 green streak: the candidate must be reliably green before it runs on every push), 4/9 (#68, feedback job already gone), and 6/9 (the tarball-approval required check already removed from the ruleset).

Decision: #57, recorded in ADR 0006 (2026-09-02 amendment, PR #62).

Scope

The candidate runs one uniform job set on every push to main — every main SHA release-eligible — plus nightly as drift canary; it leaves PRs entirely.

• exact-package-candidate.yml:
  • Triggers: drop pull_request and merge_group; keep push: main, schedule, workflow_dispatch.
  • Delete the quality and render-regressions jobs (duplicates of ci.yml / performance.yml).
  • Run minimum-android-runtime and minimum-ios-runtime uniformly (remove their schedule || workflow_dispatch guards) so every main SHA proves the floors.
  • Deduplicate verification: one verify-package-artifact invocation and one sha256 assertion per artifact hand-off (currently duplicated at ~lines 121 and 737–740).
  • Add the CocoaPods cache pattern from ci.yml to the candidate's iOS jobs.
  • Add the nightly peer-version canary: a new schedule-only, non-gating job installing the candidate against the latest React Native, Reanimated, and Gesture Handler releases (not in approve-candidate's needs; failure alerts without blocking).
  • Update approve-candidate needs/conditions for the removed and added jobs.
• release.yml needs no change: its workflow_run trigger already gates on event == push && head_branch == main, so nightly canary runs cannot publish.

Ruleset / required-check changes

None (done in 6/9).

Acceptance criteria

• Candidate runs on push to main and nightly only; a test PR triggers no candidate jobs.
• All gating jobs (tarball, consumers, floors, contract, parity) run on a plain push to main; nightly additionally runs the peer canary; peer-canary failure does not fail approve-candidate.
• Exactly one sha256 assertion per artifact hand-off remains.
• A candidate success on main triggers release.yml via workflow_run end to end.