chore: harden the /release process (retro of v0.8.10–v0.9.2)

[anandgupta42]

Full-trace retro of the last three /release runs (committed as .github/meta/release-retro-2026-07-22.md) found recurring failure classes:

• v0.9.1 nearly published a wrong artifact: a stale local tag made git tag no-op and pushed a tag pointing at a 2641-commit-divergent commit
• v0.9.2 hit another fork-inherited tag collision and smoke-tested a stale 0.7.3 global binary while releasing 0.9.2
• publish-npm was never gated on the test job — npm could publish with tests red
• an unchecked diverged beta line turned the v0.9.1 release into a 17-hour merge side-quest
• pre-release check false-passed via a trailing status-echo exit code

Fix: deterministic script/release-preflight.ts gate, fail-closed tag handling, atomic push, publish gated on tests, tag validated before publish, skill/doc updates.

[sahrizvi]

Resolved in v0.9.3 — published to npm as @altimateai/altimate-code@0.9.3 (2026-07-23).