fix(release): scope publication to the pending release candidate

[f0rr0]

Publication of a merged Release Please candidate stopped on changes to products outside that candidate. For the seven-product release in #250, the global tag planner rejected oliphaunt-broker 0.3.0 because its shared Cargo lock and release metadata had changed, before publication could use the successful exact-SHA qualification.

Derive the product scope from the latest verified release commit before tag planning, then plan only that scope. Preserve the complete release graph for shared-source impact and dependency validation, the final exact product-set proof, immutable tag/version checks, and exact-SHA qualification. Unscoped planning keeps its existing unversioned-change checks. Product versions and release PR lifecycle labels are unchanged.

Validation:

• Full tools/release/release-check.sh, including release metadata and synchronization checks.
• Full tools/ci/check-workflows.sh, including actionlint, zizmor, workflow security, CI gates and artifact transfers.
• Extension-model check and changed-file formatting/lint checks.
• Reproduced the current unscoped broker failure and verified that scoped planning selects exactly all seven products from chore(release): prepare main releases #250.
• Regression checks cover later commits after the release bump, invalid scopes, unchanged selected versions, and shared inputs outside the selected scope.

After merge, dispatch Release with operation=publish on current main. The workflow will reuse covering qualification for that exact commit or request selected-product CI. The earlier failed publication run never prepared a frozen candidate, so it cannot authorize cross-commit artifact recovery.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
oliphaunt-docs	Ready	Preview	Oct 6, 2026 5:23am UTC