[release] Self-verify release-gate changes before the next publish

[kang-heewon]

Priority

P2

Problem

The release workflow decides whether to run release work from a narrow release_work_pattern. That pattern covers changesets, package versions/changelogs, the root package manifest, and the lockfile, but it does not cover changes to the release workflow or scripts that define publish-blocking gates.

A PR can therefore change release-gate logic without forcing the workflow to self-verify that gate before the next publish path depends on it.

Evidence

• .github/workflows/release.yml defines release_work_pattern for .changeset/(pre.json|*.md), packages/*/(package.json|CHANGELOG.md), root package.json, and pnpm-lock.yaml.
• The same workflow and repository scripts enforce publish-critical checks, including scripts/package-entrypoint-smoke.mts, scripts/package-bin-smoke.mts, scripts/package-manifest-contracts.mjs, scripts/release-docs-check.mts, and scripts/changeset-required-check.mts.
• scripts/tests/release-workflow.spec.ts intentionally verifies that ordinary non-release-only changes skip release work, so the fix should target release-gate machinery changes rather than all source changes.

Desired outcome

Changes to release workflow logic or publish-gate scripts trigger a focused self-verification path before they can affect an actual publish.

Proposed implementation

1. Add an explicit release-gate-maintenance path group for release workflow files and publish-gate scripts.
2. Run the smallest useful verification set for those changes, such as workflow tests plus package manifest/bin/entrypoint dry-run checks where applicable.
3. Keep ordinary source-only changes on the existing skip behavior unless they also include release metadata.
4. Extend release-workflow.spec.ts to capture the new trigger behavior.

Acceptance criteria

• A PR changing .github/workflows/release.yml or publish-gate scripts cannot skip all release-gate verification.
• A PR changing only ordinary source files still follows the existing release-work skip behavior.
• Tests document the difference between release metadata changes, release-gate machinery changes, and ordinary source changes.

Validation

• Run pnpm vitest run scripts/tests/release-workflow.spec.ts or the repository's script-test command.
• Run the focused release-gate checks selected for this maintenance path.
• Confirm the workflow path-filter behavior with fixtures for workflow/script changes.

Scope boundaries

This should not make every source change run the full release workflow. The target is self-verification for the workflow and scripts that define publish readiness.