[release gate] make Release workflow tag-idempotent and clean orphan drafts

[Vonng]

Problem

The mc Release workflow can be triggered both by a RELEASE.* tag push and by workflow_dispatch. Without per-tag serialization and explicit retry semantics, concurrent runs created duplicate same-tag Draft releases and split assets across failed jobs.

Incident evidence:

• Published RELEASE.2026-08-26T00-00-00Z plus orphan Draft release ID 377272417 with 7 duplicate assets.
• Published RELEASE.2026-08-26T17-15-27Z plus orphan Draft release ID 377309241 with 7 duplicate assets.
• Tag-push Release run 32995378797 failed after a same-tag manual run had already created assets.

Selected semantics

• Serialize release jobs by resolved tag with cancel-in-progress: false.
• Validate the RELEASE.YYYY-MM-DDTHH-MM-SSZ tag, require it to resolve to the checkout, and pass it explicitly as GORELEASER_CURRENT_TAG.
• Fail fast if exactly one published release exists for the tag.
• Replace exactly one existing Draft from scratch through GoReleaser's replace_existing_draft.
• Fail fast when more than one matching release exists; duplicate Draft cleanup is deliberate and manual.
• Keep per-asset replacement disabled. Retry replaces the whole Draft; package upload has no --clobber.
• Reconfirm that exactly one Draft exists immediately before package upload.
• Leave a failed run's Draft available for inspection; the next retry replaces it.
• Remove orphan Drafts 377272417 and 377309241 without touching the corresponding published releases.

Local implementation

• Commit: f08111c6 ci: make release retries tag-idempotent
• Release-state decisions live in buildscripts/check-release-state.sh with fixture coverage in _test.sh.
• test-release.yml watches, syntax-checks, executable-checks, and runs both scripts.
• The commit is local and unpushed; the hash will resolve on GitHub only after the follow-up PR is published.

Verification and close criteria

• actionlint v1.7.12 passes across all workflows.
• Exact GoReleaser v2.17.1 validates .github/goreleaser.yml.
• Fixture tests cover absent, required-Draft absent, Draft, required Draft, published, duplicate Drafts, wrong tag, malformed JSON, and invalid tag.
• Live read-only checks reject the current published tag, accept an absent tag before build, reject absent/published state when a Draft is required, and fail closed on an inaccessible repository.
• make verifiers, go test ./..., bash syntax, and git diff --check pass locally.
• Push a focused PR and require hosted CI green.
• Exercise one controlled Draft build only after all source blockers are closed.
• Verify a retry leaves exactly one Draft with one copy of every archive and package asset.
• Verify a published-release rerun fails before any build or upload.

Do not create a new production tag until the remaining remote and controlled-Draft checks are complete. The existing published releases remain unchanged.

[Vonng]

Local implementation and cleanup evidence — 2026-08-29

• Local DCO commit: f08111c6.
• Deleted orphan Draft release IDs 377272417 and 377309241 after confirming each was a Draft with 7 duplicate assets.
• Published release IDs 377263156 and 377309040 remain published with 19 assets each.
• No Release/Test Release workflow, tag, package publication, or deployment was triggered.

Keep this issue open for PR/hosted CI and the later controlled Draft/retry acceptance.

[Vonng]

PR submitted

The focused remote branch is now PR #11, commit 9a3805da.

This supersedes the original local-only f08111c6 hash after rebuilding the review branch directly from origin/main. Fixture tests, actionlint 1.7.12, GoReleaser validation, and full unit tests pass locally. Hosted CI and the later controlled Draft/retry exercise remain open; no Release/Test Release workflow or tag was triggered.