Wait for CI approval before publishing releases

For release publishing, follow the label-driven workflow rather than attempting to publish early. Prepare the release and approve its publish request, then wait for all required CI workflows to finish. Treat ci-pending as a block; the poller adds ci-ready once CI passes, which triggers publishing when the request is also accepted. Monitor the publish workflow through completion and verify that the release artifact exists only after the run succeeds.