The guarded-recovery refactor added dispatch-contract/authorize-recovery
jobs that are skipped on ordinary tag pushes. The downstream
release/verify/publish jobs gated only on `needs.X.result == 'success'`,
so GitHub added an implicit success() that treats the skipped ancestors
as a chain failure and silently skipped the entire publish chain — a
pushed annotated tag validated the contract but delivered nothing.
Add an explicit `!cancelled()` status check to the release,
verify-darwin-signatures, publish-release, publish-channels, and
mirror-gitee-release gates. This disables the implicit success() while
keeping the existing result==success conditions, restoring direct
tag-push delivery. Protected recovery remains the failure break-glass;
its ancestors succeed, so its behavior is unchanged.
修雨
1ed5de2374