feat(sdk-release-gate): expose release states

[gavinsharp]

Summary

The shared SDK release gate now reports whether a generated release should publish, repair release metadata, or skip because the version tag belongs to another commit.

Changes & impact

SDK callers can replace local release prechecks with release_state, should_publish, should_finalize, and existing_version_tag_commit; existing tags on other commits now skip instead of failing.

Details

• publish: tag absent; publish and finalization are enabled.
• repair: tag points at current commit; publish is disabled and finalization is enabled.
• skip: tag points at another commit; publish and finalization are disabled.
• OpenAPI verification remains limited to new publishes.

Testing

• actionlint .github/workflows/sdk-release-gate.yml
• git diff --check

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes shared release-gate contract and tag-mismatch behavior for all SDK callers; mis-wired consumers could skip publish or finalize incorrectly.

Overview
The reusable sdk-release-gate workflow now classifies each run as publish, repair, or skip instead of only “publish or bail.” Callers get should_finalize, release_state, and existing_version_tag_commit alongside the tightened should_publish semantics.

When the version tag already points at HEAD, publish is skipped but finalization is still allowed (repair) so metadata can be fixed without republishing. When the tag points at another commit, the job exits successfully with skip rather than failing—non-release commits no longer break the pipeline. OpenAPI verification is unchanged: it still runs only when should_publish is true.

README wording for the gate is updated to match the publish / repair / skip model.

^{Reviewed by Cursor Bugbot for commit b3fc3a7. Bugbot is set up for automated code reviews on this repo. Configure here.}