The CI green gate queried gh api for check-run status, but in test
environments the commit SHA doesn't exist on GitHub, causing HTTP 422.
Downgrade api_error from violation to warning so the guard remains
functional in offline/test contexts while still blocking on real CI
failures (pending, not_found on actual repos, non-success conclusions).
- release_trigger_guard.py: block publish if CI Required Gate hasn't
passed on the tag commit; warn if no prior dry-run exists
- cut_release_tag.sh: check CI status via gh api before creating tag;
run cargo check --locked to catch stale Cargo.lock locally
- ci-post-release-validation.yml: new workflow triggered on release
publish — validates asset count, SHA256 checksums, and binary version
