ci: make the exact package candidate the sole push-to-main gate (#74)

[thiagobrez]

Closes #74. Decision: #57, recorded in ADR 0006 (2026-09-02 amendment, #62).

What changed in exact-package-candidate.yml

• Triggers: dropped pull_request and merge_group; the candidate now runs on push: main, nightly schedule, and workflow_dispatch only. The CANDIDATE_CHANNEL expression loses its unreachable pull-request fallback.
• Deleted quality and render-regressions — duplicates of ci.yml / performance.yml, which own those checks at the PR lifecycle point per the ADR 0006 gate placement map.
• Runtime floors run uniformly: minimum-android-runtime and minimum-ios-runtime lose their schedule || workflow_dispatch guards, so every main SHA proves the floors; renamed to drop the now-false "Nightly" prefix.
• Deduplicated verification: one verify-package-artifact invocation (in candidate) and one sha256 assertion per artifact hand-off remain — clean-package-consumers and approve-candidate each assert once; the duplicate manifest recheck in approve-candidate is gone.
• CocoaPods cache from ci.yml added to the contract job's Apple configurations (cache example/ios/Pods keyed on example/ios/Podfile.lock, skip pod install on hit). The other iOS jobs build freshly generated consumers with no committed Podfile.lock, so the ci.yml pattern does not map to them.
• Nightly peer-version canary: new schedule-only job that installs the candidate into a fresh bare app against the latest React Native, Reanimated, and Gesture Handler releases (plus latest react/worklets as required transitives) and proves TypeScript, Babel worklet transform, and autolinking. Deliberately absent from approve-candidate's needs, so a failure alerts on the nightly run without blocking any push candidate or publication.
• approve-candidate needs/if updated: removed jobs dropped; the floors are now required to succeed on every event.
• Concurrency (review finding): push runs now group per SHA instead of per ref, so consecutive pushes to main no longer cancel each other's candidate — without this, a cancelled run leaves its SHA release-ineligible, contradicting the issue's headline. Nightly/dispatch keep the per-ref group and still cannot cancel a push run.

release.yml is untouched: its workflow_run gate (conclusion == 'success' && event == 'push' && head_branch == 'main') already prevents nightly canary runs from publishing. docs/releasing.md line 90 updated to stop claiming the candidate runs "performance checks".

Acceptance criteria

• Candidate runs on push to main and nightly only; PRs trigger no candidate jobs (triggers removed).
• All gating jobs (tarball, consumers, floors, contract, parity) run on a plain push to main; nightly adds the peer canary, whose failure cannot fail approve-candidate (not in needs).
• Exactly one sha256 assertion per artifact hand-off remains.
• A candidate success on main still reaches release.yml via the unchanged workflow_run trigger.

Validation: YAML parses; yarn lint, yarn typecheck, full yarn test (29 suites / 285 tests), and yarn test:release all pass. Two-axis code review (standards + spec) ran; both findings it surfaced (push concurrency, unpinned canary CLI rationale) are addressed above.

🤖 Generated with Claude Code