chore: skip redundant checks on release, enforce main HEAD in bin/release (#18)

Add an origin/main HEAD guard to bin/release so releases can only be
cut from the latest CI-verified main commit. With that invariant,
remove the check job from both release workflows (release.yml,
release-python.yml) and delete the now-orphaned check.yml reusable
workflow. bin/check still runs locally as a safeguard.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: lostmygithubaccount

.github/workflows/check.yml

@@ -13,12 +13,8 @@ permissions:
   contents: read
 
 jobs:
-  check:
-    uses: ./.github/workflows/check.yml
-
   build:
     name: Build (${{ matrix.target }})
-    needs: check
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -60,7 +56,6 @@ jobs:
 
   sdist:
     name: Build sdist
-    needs: check
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

.github/workflows/release-python.yml

@@ -13,12 +13,8 @@ permissions:
   contents: read
 
 jobs:
-  check:
-    uses: ./.github/workflows/check.yml
-
   build:
     name: Build (${{ matrix.target }})
-    needs: check
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false

.github/workflows/release.yml

@@ -10,13 +10,14 @@ usage() {
   echo "Tag and push a release for the current version."
   echo ""
   echo "Pre-flight checks:"
+  echo "  - HEAD matches origin/main (override with --force)"
   echo "  - Working tree is clean (override with --allow-dirty)"
   echo "  - bin/check passes"
   echo "  - Git tag does not already exist on GitHub"
   echo "  - Package version does not already exist on PyPI"
   echo ""
   echo "Options:"
-  echo "  --force        Skip GitHub tag and PyPI existence checks"
+  echo "  --force        Skip GitHub tag, PyPI, and origin/main checks"
   echo "  --allow-dirty  Skip clean working tree check"
   exit "${1:-0}"
 }
@@ -60,6 +61,22 @@ else
   echo "  skipping clean working tree check (--allow-dirty)"
 fi
 
+# ---------- verify HEAD is latest main ----------
+
+if [ "$FORCE" = false ]; then
+  git fetch origin main --quiet
+  LOCAL_SHA=$(git rev-parse HEAD)
+  REMOTE_SHA=$(git rev-parse origin/main)
+  if [ "$LOCAL_SHA" != "$REMOTE_SHA" ]; then
+    echo "ERROR: HEAD ($LOCAL_SHA) does not match origin/main ($REMOTE_SHA)." >&2
+    echo "       Check out the latest main before releasing, or use --force to override." >&2
+    exit 1
+  fi
+  echo "  HEAD matches origin/main"
+else
+  echo "  skipping origin/main check (--force)"
+fi
+
 # ---------- run checks ----------
 
 echo "Running bin/check..."