fix(ci): run Docker release after aggregate gate

Author: Medformatik

.github/workflows/ci.yml

@@ -529,7 +529,10 @@ jobs:
   release:
     name: build, scan, and publish Docker release
     needs: ci
-    if: needs.ci.result == 'success' && github.event_name == 'push' && github.ref == 'refs/heads/main'
+    # The aggregate gate intentionally depends on PR-only Docker jobs, which
+    # are skipped on pushes. Force evaluation past GitHub's transitive skipped-
+    # dependency propagation, then admit only a successful trusted main push.
+    if: always() && needs.ci.result == 'success' && github.event_name == 'push' && github.ref == 'refs/heads/main'
     permissions:
       contents: read
       packages: write

scripts/docker-release-contract.test.ts

@@ -20,6 +20,7 @@ describe("Docker release trust gate", () => {
     expect(release).not.toContain("workflow_dispatch:");
     expect(ci).toMatch(/^ {2}release:\n/m);
     expect(ci).toContain("needs: ci");
+    expect(ci).toContain("if: always() && needs.ci.result == 'success'");
     expect(ci).toContain("needs.ci.result == 'success'");
     expect(ci).toContain("github.event_name == 'push'");
     expect(ci).toContain("github.ref == 'refs/heads/main'");