fix(release): gate on the head rung's CI verdict, not an in-container test run

make quality inside the production orchestrator container fails on
~1000 clean-env assumptions (armed compose flags, live Redis, host
mounts) for a tree that is green in CI — proven live on the first
org-proposed release. The execute-time gate now re-verifies the head
rung's CI conclusion, fail-closed on absent or red with branch, sha,
and conclusion in the failure detail; the pushed release commit keeps
its own CI wait before publish.

tests/unit/services/test_release_executor.py

@@ -104,9 +104,9 @@ class _FakeOps:
     async def write_changelog_entry(self, _entry: str) -> None:
         self.calls.append("changelog")
 
-    async def run_gate(self) -> bool:
+    async def run_gate(self) -> tuple[bool, str]:
         self.calls.append("gate")
-        return self._gate
+        return self._gate, "CI on slave@deadbeef is failure"
 
     async def commit_and_push(self, _version: str) -> str:
         self.calls.append("commit")