Prevent skipped stable publishers and enable safe recovery / 防止稳定发布任务被跳过并支持安全恢复

[SivanCola]

Problem

The stable v1.17.15 orchestrator run completed green after approval, but every real CLI, npm, and Desktop publication job was skipped. The reusable workflows joined a successful orchestrator guard with a deliberately skipped standalone approval job; GitHub propagated that skipped ancestor beyond the cache guard because the publication descendants had no explicit status condition.

The documented workflow_dispatch recovery path was also ineffective after a workflow fix: it checked out and executed control scripts from the old release tag and required that tag to remain current main-v2.

Broken run: https://github.com/esengine/DeepSeek-Reasonix/actions/runs/29622254856

Fix

• Add explicit success conditions to the CLI, npm, and every Desktop publication stage so the intentionally skipped alternate authorization branch cannot suppress publication.
• Keep recovery authorization, tag resolution, and postflight logic on protected main-v2 while the actual builds remain pinned to the immutable approved historical release SHA.
• Require all three stable tags to resolve to one commit that is an ancestor of current main-v2; normal tag-push releases still require the exact current main-v2 commit.
• Add a final stable postflight that fails unless all three reusable publishers succeed, required CLI/Desktop GitHub Release assets exist, and npm latest exactly matches the approved version.
• Extend the release workflow contract tests with current-tag, historical recovery, stale control-plane, moved-tag, mismatched-tag, and non-ancestor cases.

Recovery

After this PR merges, dispatch Release stable from protected main-v2 with tag v1.17.15. It will retain the existing v1.17.15, npm-v1.17.15, and desktop-v1.17.15 tag targets, request one release-environment approval, build the original candidate SHA, and verify every public artifact at the end. No tag movement or recreation is required.

Verification

• bash scripts/release-workflows.test.sh
• actionlint v1.7.7 on all four release workflows, with the repository CI ignore for the GitHub-hosted windows-11-arm label
• bash -n on all changed release scripts
• public artifact postflight against v1.17.14
• ./scripts/cache-guard.sh — all eight scenarios pass, tail averages 92–95 against threshold 90
• go test ./...
• git diff --check

Compatibility and cache

Surface	Existing behavior	Result
Stable tag push	Requires all three tags on exact current main-v2	Preserved
Existing release tags	Recovery reads the immutable historical SHA and never moves tags	Safe
Standalone RC/canary	Keeps the existing standalone gate/channel behavior	Preserved
Persisted app/config/session formats	Not touched	No migration or coexistence impact

Cache impact: none. No provider-visible prompt, tool schema/order, request serialization, compaction, memory, or provider code changed. The cache guard remains green.