feat(release): /publish refuses to tag a main commit whose ci run is red, pending or missing

[using-system]

Closes #53

What

/publish's preflight now reads the ci run of the commit origin/main names (gh run list --workflow ci.yml --event push --branch main --commit <sha> --limit 1 --json databaseId,status,conclusion,url) and stops, naming the run, unless it exists, is completed and concluded success:

• no run: ci never ran for that commit - say so, never tag it;
• not completed (queued, in_progress, waiting, ...): offer gh run watch, preflight again once done;
• not success (failure, cancelled, timed_out, ...): point at gh run view --log-failed; recovery is a fix merged to main or, for a transient cause, gh run rerun --failed, then the preflight again once green.

The "Releases" section of AGENTS.md names the new condition. The gate lives in the command only: release.yml is unchanged (it never checked ci, and still does not - the command says so).

Why

main at e2b4032 has a red ci run (https://github.com/using-system/oddyssey-actions/actions/runs/35471779837 - a transient curl: (35) Connection reset by peer fetching the Claude Code manifest in setup-claude), and /publish would have tagged it: it checked the last release run, never the ci run of the commit about to ship.

Amendments to the issue

Recorded on #53: CONTRIBUTING.md is left unchanged (it never describes /publish), and the query carries --event push so a pull_request run of a head branch named main on the same commit never stands in for the push run.

Review

Review subagent and security review both green after one round (dash placement, "URL when there is one", the cancelled case re-fetches before saying "by hand", the deviation recorded on the issue). actionlint, shellcheck, ruff, pytest (221 passed) green locally; no script or workflow is touched.

🤖 Generated with Claude Code