fix(release): annotate PREPARE terminal failures

[kattsushi]

Closes #239

Type

• Bug fix
• New feature
• Documentation only
• Code refactoring
• Maintenance/tooling
• Breaking change

Summary

• Add distinct fail-closed annotations for PREPARE's local commit, post-commit clean-tree, and release-branch push gates.
• Preserve the exact successful commit command/message, cleanliness check, and branch refspec.
• Keep diagnostics fixed and public, without command output, configuration, environment values, or credentials.

Motivation

Run 33188363469 failed after deterministic staging passed, but GitHub did not retain raw logs. The remaining terminal gates could not be distinguished safely without explicit annotations; changing credentials, hooks, or rules would be speculative.

Changes

File	Change
.github/workflows/cd.yml	Wrap the three terminal gates with fixed-text fail-closed annotations.
scripts/release-policy-contract.test.mjs	Add mutation and shell-stub coverage for all failure/success paths.

Test plan

• node --test scripts/release-policy-contract.test.mjs — 18/18 passed.
• Removing any guard or annotation fails the focused contract.
• Commit, dirty-tree, and push stubs each emit only the matching fixed annotation, exit 1, and skip later commands.
• Success stubs reach the sentinel.
• YAML, Nx lint, formatting, scope, and diff checks pass.

Contributor checklist

• Linked approved issue fix(release): annotate PREPARE terminal gate failures #239.
• Added exactly one type:* label: type:bug.
• Exactly two files and 90 additions plus deletions.
• Conventional commit with no Co-Authored-By trailer.
• No workflow dispatch, remote ref/tag, GitHub Release, or npm publication occurred while preparing this PR.

[coderabbitai]

Warning

Review limit reached

Next included review available in 11 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 487fc626-50b0-4abd-8d3b-efd5975c4c95

📥 Commits

Reviewing files that changed from the base of the PR and between d33cff4 and ed359f8.

📒 Files selected for processing (2)

• .github/workflows/cd.yml
• scripts/release-policy-contract.test.mjs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}