- release_trigger_guard.py: block publish if CI Required Gate hasn't
passed on the tag commit; warn if no prior dry-run exists
- cut_release_tag.sh: check CI status via gh api before creating tag;
run cargo check --locked to catch stale Cargo.lock locally
- ci-post-release-validation.yml: new workflow triggered on release
publish — validates asset count, SHA256 checksums, and binary version