fix(release): publish after skipped rebuild

[rabii-chaarani]

Summary

• keep Release triggered only by completed CI runs on main
• prevent the intentionally skipped rebuild job from suppressing asset and crate publication
• require successful direct prerequisites and affirmative publication authorization
• add workflow policy regressions for both publisher jobs

Verification

• cargo run -p xtask --locked -- check-workflows
• cargo run -p xtask --locked -- release-gate
• cargo test -p xtask --locked
• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings

Incident

In Release run 31993773993 attempt 1, CI had already completed successfully and artifact validation passed. The rebuild job was correctly skipped because retained CI artifacts were promoted, but GitHub propagated that skipped ancestor and silently skipped both publication jobs. This change explicitly overrides only that inherited skipped status while retaining fail-closed result checks.