[blessdyb]

Summary

• replace Release's duplicate newest-Xcode test run with an exact-commit evidence gate
• require an open or merged PR targeting main at the checked-out tag SHA
• require the latest successful oldest/newest Xcode, site, change-detection, Swift/Python/Actions CodeQL, and aggregate CodeQL checks from trusted GitHub apps
• retain release signing, notarization, Gatekeeper, checksums, publication, and Homebrew validation unchanged
• document that CI owns tests and Release consumes their exact-SHA evidence

Why

Flowlight 0.16.11 commit 605d45e1 ran the full suite in CI's newest-Xcode job and then ran the same xcodebuild test command again in the Release dry run. The duplicate Release test added 6m38s of macOS runner time without testing different code or a different product graph.

Verification

• python3 scripts/test_release_checks.py — 8 tests passed
• real 0.16.11 API evidence accepted for PR Flowlight 0.16.11 — refine visualization and launcher lineage #76 at exact SHA 605d45e1
• evidence with test (newest Xcode) removed rejected with exit 1
• edited workflow YAML parsed successfully
• git diff --check

🤖 Generated with Claude Code