package-release: the gate once; a tag whose tree passed its PR's verify runs only the cast guard (merge after callers)

[Soul-Craft]

Error-log row 112: every v* tag re-ran the full package gate (about 17 runner-minutes) on a tree its pull request had already passed. Eight releases waited up to 2 h 15 min on the two free runners.

The gate runs once. The tag job:

1. checks the tag against PKG_VERSION, as before;
2. finds the merged pull request whose merge_commit_sha is the tag's commit;
3. checks that the PR head's tree equals the tag's tree, i.e. the PR was up to date, so its gate saw exactly this tree;
4. checks that the head has a green verify / verify check run.

Then:

• All true: only guard runs. That is the cast guard, required, on the tagged zip, the one thing the PR gate does not enforce. It takes seconds, then release.
• Anything else: gate, the full package-ci.yml with require-cast-guard: true, as today. That covers no such PR, another tree, a red or missing verify, or an unreadable API. The job summary says which case applied and why.
• release is unchanged (gh release create with the zip, the handbook title and --generate-notes). It needs tag to pass and either gate or guard.

Merge order matters. The tag job now asks for pull-requests: read and checks: read, and a reusable workflow cannot get more than its caller grants: GitHub refuses to start the run otherwise. So each package's release.yml must first add:

    permissions:
      contents: write
      pull-requests: read
      checks: read

Merge this PR only after all nine callers grant them.

🤖 Generated with Claude Code