Always preserve CI-poller ci-ready label emission

When modifying publish or CI-poller workflows, preserve the invariant that the CI poller always adds/re-adds the ci-ready label after successful CI. Treat this label operation as an intentional event emission that triggers publishing and resolves the waiting-for-ci race; do not optimize it away merely because ci-ready may already be present. Keep publish gating and workflow comments consistent with this behavior, and ensure security hardening does not prevent the poller from producing the required ci-ready event.