fix(release): gate Release PR transitions

[gustavovalverde]

Motivation

The v6.2.2 Release PR was merged outside the Mergify queue before approval and Release readiness completed. The post-merge controller initially rejected it, but accepted a late approval on rerun because it queried the PR's live review decision instead of verifying the merge path.

The release squash push also ran release-plz while v6.2.2 was still absent from crates.io, which created the immediate duplicate Release PR #11087. Automatic publication needs one supported transition, and release-plz must not react to its own release commit.

Part of #11092.

Solution

Require GitHub to report the mergify bot as the Release PR merge actor before automatic publication can start. This reuses the existing Mergify queue conditions as the approval and check boundary; a direct or administrator merge remains blocked on every rerun and requires explicitly authorized break-glass recovery.

Give every generated Release PR the reserved chore: release title prefix, and skip Release PR generation for both that prefix and commits authored by the zebra-release app. The generated checklist and release documentation now identify approval followed by Mergify queueing as the single automatic path, while the existing manual check and resume dispatches remain exit hatches into the same controller.

Tests

actionlint, zizmor --pedantic, markdownlint, TOML parsing, and focused release-transition fixtures pass. Live GraphQL evidence confirms that a queued Zebra merge records mergedBy as the mergify bot while the v6.2.2 direct merge records a user.

Specifications & References

• devops: parallelize release artifact preparation #11092
• Tracking: streamline Zebra's software delivery lifecycle #10962
• Mergify queue configuration

Follow-up Work

This PR closes the observed release-squash self-trigger, not the full registry blind window. An unrelated push to main before the previous Cargo release reaches crates.io can still make the prior changes appear unreleased. #11092 tracks the release-in-flight boundary, Cargo acceleration, parallel artifact preparation, rehearsals, and the final single-owner cutover.

AI Disclosure

• No AI tools were used in this PR
• AI tools were used: OpenAI Codex for release analysis, implementation, validation, and PR drafting; Claude Opus 5 for an independent architecture review.

PR Checklist

• The PR title follows conventional commits format: type(scope): description
• The PR follows the contribution guidelines.
• This change was discussed in devops: parallelize release artifact preparation #11092.
• The solution is tested.
• The documentation and changelogs are up to date. CI and workflow changes do not require a changelog entry.