ci(release): use curl instead of gh CLI for verify-ci gate (#103)

v0.9.2 tag push hit `gh: command not found` on the Rocky runner that
picked up the release job — the verify-ci preflight introduced in #98
calls `gh api`, but `gh` is not installed across every self-hosted
Linux label. Rewrite the check with `curl + jq`; both are already
dependencies elsewhere in the release pipeline.

This leaves the security posture unchanged: the gate still aborts the
release if the latest CI run on the tagged SHA has any conclusion
other than `success`. It just no longer fails-open when the runner
lacks an optional CLI.

Fixes #103.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: rayketcham

.github/workflows/release.yml

@@ -27,11 +27,17 @@ jobs:
         run: |
           set -euo pipefail
           echo "Checking CI status for $REPO @ $SHA"
-          # Take the most recent completed CI.yml run on the exact commit SHA.
-          status=$(gh api "repos/${REPO}/actions/workflows/ci.yml/runs?head_sha=${SHA}&per_page=1" \
-            --jq '.workflow_runs[0] | {status: .status, conclusion: .conclusion, html_url: .html_url}')
-          echo "$status"
-          conclusion=$(echo "$status" | jq -r '.conclusion // "missing"')
+          # Use curl + jq (always present on self-hosted runners) — avoids
+          # a hard dep on the gh CLI, which is not installed on every
+          # [self-hosted, Linux] label in our fleet (see release run
+          # 24915505204 where the gate died with `gh: command not found`).
+          response=$(curl -fsS \
+            -H "Authorization: Bearer ${GH_TOKEN}" \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            "https://api.github.com/repos/${REPO}/actions/workflows/ci.yml/runs?head_sha=${SHA}&per_page=1")
+          echo "$response" | jq '.workflow_runs[0] | {status, conclusion, html_url}'
+          conclusion=$(echo "$response" | jq -r '.workflow_runs[0].conclusion // "missing"')
           if [[ "$conclusion" != "success" ]]; then
             echo "::error::CI has not passed on ${SHA}: conclusion=${conclusion}. Aborting release."
             exit 1