ci(release): T502/T503 promote home-latest and the Release only after the stack gate (gh-#777)

[genwave-radio]

PR-9 of gh-#777 · STORY-448 · T502 + T503

🚦 What changes

• T502 .github/workflows/release.yml: a stack-gate job (needs merge-manifests, 40 min, fetch-depth: 0, ffmpeg) runs tools/gate/stack_gate.sh --tag "$GW_TAG" --fresh --upgrade --capture --report gate-report and uploads gate-report/ (7 days, if: always()). merge-manifests now tags only home-<tag>; a new promote job (needs stack-gate) retags the five images as home-latest; create-release (needs promote) downloads the report and creates the Release with --generate-notes --notes-file notes.md, where notes.md is "## ✅ What this release proved" + gate-report.md. SPEC F179.2–F179.5. Pins: Story448_ReleaseWorkflowGate.cs (21 facts, no longer skipped).
• T503 tools/gate/stack_gate.sh: the upgrade leg now runs last, after capture/chaos, and teardown_project brings the fresh stack down first (see below).

🧪 T503 transcript — the stack-gate step body replayed on the dev box

GW_TAG=v5.8.3, GH_TOKEN from gh auth token, dev station stopped, the step body run verbatim.

Run 1 (16:42, before the fix) — exit 1, 441 s. The upgrade leg failed at setup: v5.8.2's setup.sh preflight reported Port 8080 is already in use. Cause: the script ran fresh → upgrade → capture, but the capture leg records the fresh stack, so the fresh project was still up when the previous release's stack tried to bind the same fixed host ports (compose.yaml publishes 8000/8080/8081/3000). T495 only ever ran --upgrade alone and the nightly runs --fresh --capture --chaos, so this combination had never run before release.yml asked for it.

leg	result	detail
fresh	ran/passed	-
upgrade	ran/failed	setup
capture	ran/passed	- (−21.0 LUFS, 0 silence events, booth_log 15)

Run 2 (17:22, after the fix) — exit 1, 539 s. Upgrade passes; the only red is the capture loudness check, which is gh-#797 (pre-existing, unrelated to this PR).

leg	result	detail
fresh	ran/passed	-
upgrade	ran/passed	previous v5.8.2, health 5 s, role boundary ok
capture	ran/failed	loudness: −21.1 LUFS vs −16, tolerance 5

No leftover gw-gate compose projects or worktrees after either run; the dev station came back with start.

Notes ordering: gh help release create confirms --generate-notes and --notes-file compose: gh sends the file as the body with generate_release_notes on, and GitHub prepends a supplied body to its generated notes, so the proof section comes first. No throwaway tags or draft releases were created to check this.

⚠️ Not exit 0 yet

The T503 acceptance says exit 0. The port-collision defect this task found is fixed and proven above; the remaining red is gh-#797 (capture leg lands at −21 LUFS, 5 LU under target, sitting exactly on the tolerance edge: −21.0 passed in run 1, −21.1 failed in run 2). After this PR merges, the next tag's Release will be held by the gate until #797 is fixed. That is the gate working as designed, but it needs a decision on #797 before the next release. T503 stays unticked in the plan until the replay exits 0.

🔍 Review

• T502: one round, PASS-WITH-NOTES (a backwards notes-order comment, an over-long header line; fixed).
• T503: one round, PASS-WITH-NOTES (rationale comment duplicated four times, trimmed to one; a --chaos claim about release.yml corrected).
• Full solution green both rounds: 5229 passed, 121 skipped, 0 failed. actionlint and shellcheck -S warning clean.