ci: run the publish gate on release, not on the version PR

[unional]

The publish gate was a job on the changesets "Version Packages" PR, conditional on startsWith(github.head_ref, 'changeset-release/'). That PR is opened with the built-in GITHUB_TOKEN, and GitHub does not trigger on: pull_request workflows for a PR created by that token — so it carries zero checks and the gate has never run, once, on this repo.

This moves it into release.yml as a needs: of the release job, where it runs on main immediately before changeset publish. The gate is self-contained — it packs the working tree and diffs that against the registry — so it needs no PR context.

What this does not change

The Version PR still merges by admin override, exactly as today. Nothing here makes anything auto-mergeable, and no auto-merge is armed.

Fails closed

Because it is a needs: of release, the gate also runs on pushes that only open or update the Version PR rather than publish. That is deliberate — a bad tarball surfaces one merge earlier.

Why the other options were rejected

• Exempting changeset-release/* from the ruleset: impossible. Rulesets key on the target ref (main); there is no head-branch condition in the API.
• Merge queue: a PR must have passed its required checks before it can be queued, so the queue defers the gate rather than supplying it.
• Empty commit / close-reopen with GITHUB_TOKEN: blocked by the same restriction; GitHub's docs use exactly this as the illustrative example.
• Posting a code / all-checks commit status: "if a check and a commit status have the same name, both must pass when that name is required" — a deadlock, not a fix.
• A GitHub App token: would work, but stores a long-lived private key, against the point of the secretless migration.

Depends on

cyberuni/.github#19 must land first. Without it the gate inspects nothing on single-package repos.

🤖 Generated with Claude Code

https://claude.ai/code/session_014RLRX3QtRpgCfDt16KShQC

[changeset-bot]

⚠️ No Changeset found

Latest commit: 5106bb8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.35%. Comparing base (b542b9d) to head (5106bb8).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #349   +/-   ##
=======================================
  Coverage   96.35%   96.35%           
=======================================
  Files          24       24           
  Lines         357      357           
  Branches       63       63           
=======================================
  Hits          344      344           
  Misses         13       13           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.