Always withhold release approval until exact-head CI is fully green

For release and publish workflows, verify the CI run for the precise release branch and commit SHA before applying an approval such as the accepted label. Do not treat partially successful or still-running aggregate CI as sufficient; wait until every required job has succeeded or is intentionally skipped. Confirm release metadata, publish targets, and required commits when requested. If any check fails, inspect the complete failing logs and diagnose the root cause before making changes or approving publication. Keep the release unapproved while checks are pending, queued, or ambiguous.