Make release gates actually gate (FIG-617)

[SamGalanakis]

Cutting v0.1.0-alpha.112 exposed three failures with one shape: something that looks like a gate but does not gate. This closes them.

1. The release stamps its own docs pin

Releasing did not bump docs/released-version.txt + the README/docs pins, so the instant a tag was cut, Test docs + build cache failed on every open PR until a human noticed (#128 and #129 were both blocked by exactly this). PUBLISHING.md documented the step and stamp-docs already existed — it was simply skipped.

Now the release runs stamp-docs after publishing and commits to main directly. Safety: lints before committing; no-ops cleanly when there is no diff; rebase-and-retry up to three times on a racing push; and a failure here can never turn a successful publish red (warning + continue-on-error). Two subtleties worth noting — a GITHUB_TOKEN push does not trigger push workflows, so it explicitly dispatches ci.yml for the pin commit; and the generated docs: stamp release X.Y.Z subject is excluded from release-note collection so the next release doesn't mistake it for curated notes.

2. Perf becomes a release gate; the nightly is deleted

The nightly Performance lane had been red since 2026-07-24 and was never consulted, so alpha.111 and alpha.112 both shipped over it. Release readiness was judged from CI alone.

perf.yml's cron is removed (workflow_dispatch stays). The full budget-enforcing profile now runs as a release gate on blacksmith-16vcpu-ubuntu-2404, and publish-crates depends on it — the tag is created only after budgets pass. No budget was recalibrated and none needed to be: the enforced values are stack bytes, allocation counts and instruction counts, not wall-clock timings, so they are machine-independent.

Additionally the release now refuses a SHA whose CI run is not a completed success — missing, pending, cancelled or failed all block, reporting the run id/title/state/URL. No override.

3. Fast perf smoke on every push/PR

With the nightly gone nothing measured perf continuously, so a regression would only surface when someone attempted a release. The existing Lint job now runs both measurement paths with a quick profile and no --enforce-budgets — a functional signal that the harness is sound; budgets stay a release concern. Measured ~15–60s warm, well under the ~9 min critical path, and it adds no new job. Justification: an assertion that checked attachment position instead of survival compiled fine, could never pass, and took two days to surface because it only ran nightly (#128).

4. Corrected an over-cautious exclusion

#131 kept sim-unit-perf-guards on ubuntu-latest on the stated grounds its budgets were machine-calibrated. That rationale was wrong (see above), so it now matches its sibling shards on Blacksmith and the incorrect comment is removed.

Verification

Job/matrix display names expanded at base and HEAD: 35 entries, identical sets — no required check renamed or dropped. test_confidence_gate_ci_contract.py 25/25. Workflow behaviour is CI-only verifiable.