Release gate: publish-packages.yml releases through one entrypoint that runs the suite first; the if: pin is gone

scripts/release-after-suite.mjs runs the release-checks suite and then the
release action (npm publish, or the Python sdist and wheel build that the PyPI
step uploads) from one process, and releases only if the suite passed. No step
condition can release what the suite did not pass, so the pin that read if:
conditions (status functions, multi-line if:, the leading-conjunct rule) is
deleted with its tests and docs. What remains compares each job's release steps
with their expected text exactly, less their if: line, and refuses
continue-on-error, shell and defaults in the workflow.

Ruling asura:ruling:suite-gate-structural-not-parsed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/publish-packages.yml

@@ -55,17 +55,12 @@ jobs:
           node-version: 24.x
           registry-url: https://registry.npmjs.org
 
-      # The suite pins the release checker's rules and the declared tag prefixes
-      # (docs/semver-policy.md). It runs before any check or publish step, on a
-      # checkout that holds every tag.
+      # The release-checks suite, which Publish runs, needs .NET for the API gate.
       - name: Set up .NET
         uses: actions/setup-dotnet@v4
         with:
           dotnet-version: 10.0.x
 
-      - name: Test the release checks
-        run: node --test scripts/check-changelog-semver.test.mjs
-
       - name: Install workspace dependencies
         run: npm ci
 
@@ -92,12 +87,11 @@ jobs:
         working-directory: packages/cultcache-ts
         run: npm test
 
-      # Scoped packages default to restricted even on public npm, and this is
-      # MIT like the rest of the repo, so say public explicitly.
+      # Runs the release-checks suite, then npm publish --access public, in one
+      # process that publishes only if the suite passed (docs/semver-policy.md).
       - name: Publish
         if: startsWith(github.ref, 'refs/tags/cultcache-ts-v')
-        working-directory: packages/cultcache-ts
-        run: npm publish --access public
+        run: node scripts/release-after-suite.mjs npm-publish packages/cultcache-ts
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
@@ -155,11 +149,6 @@ jobs:
         with:
           dotnet-version: 10.0.x
 
-      # See the same step in the npm job: the suite comes before any check or publish step.
-      - name: Test the release checks
-        if: steps.selected.outputs.run == 'true'
-        run: node --test scripts/check-changelog-semver.test.mjs
-
       - name: Verify the tag matches the manifest version
         if: steps.selected.outputs.run == 'true' && startsWith(github.ref, 'refs/tags/')
         run: |
@@ -184,14 +173,16 @@ jobs:
       - name: Install and test
         if: steps.selected.outputs.run == 'true'
         run: |
-          python -m pip install -e packages/cultcache-py -e packages/cultnet-py -e packages/cultmesh-py
+          python -m pip install --upgrade build -e packages/cultcache-py -e packages/cultnet-py -e packages/cultmesh-py
           python -m unittest discover -s packages/${{ matrix.package }}/tests
 
+      # Runs the release-checks suite, then builds the sdist and wheel, in one
+      # process that builds only if the suite passed (docs/semver-policy.md).
+      # Publish uploads only what this step built, so it has nothing to upload
+      # unless the suite passed.
       - name: Build sdist and wheel
         if: steps.selected.outputs.run == 'true'
-        run: |
-          python -m pip install --upgrade build
-          python -m build packages/${{ matrix.package }}
+        run: node scripts/release-after-suite.mjs python-build packages/${{ matrix.package }}
 
       - name: Publish
         if: steps.selected.outputs.run == 'true' && startsWith(github.ref, 'refs/tags/')