ci: fail the release when the bump push is rejected and main has not moved

Any push failure was reported as 'main moved' and exited green with
stale=true, so a ruleset, token or network failure skipped tag, release,
plugin-dist and Pages on every run without a red signal. After a failed
push the job now re-fetches main: it stands down only if origin/main
advanced past the commit it checked out, and otherwise fails with an error.

Closes #516

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LpkeXRvikhJZSVGBFM91Dv
Signed-off-by: TM Hospitality Strategies <TMHospitalityStrategies@gmail.com>

Author: TMHSDigital

.github/workflows/release.yml

@@ -266,9 +266,17 @@ jobs:
           else
             git commit -s -m "chore: bump version to ${{ steps.new.outputs.version }} [skip ci]"
             if ! git push origin main; then
-              echo "::notice::push rejected (main moved); the newer release run will publish this range"
-              echo "stale=true" >> "$GITHUB_OUTPUT"
-              exit 0
+              # Stand down only when main really moved. Any other rejection
+              # (ruleset, token, permissions, network) must fail loudly, or
+              # every release stalls behind a green run (#516).
+              git fetch -q origin main || true
+              if [ "$(git rev-parse origin/main)" != "$(git rev-parse HEAD~1)" ]; then
+                echo "::notice::push rejected (main moved); the newer release run will publish this range"
+                echo "stale=true" >> "$GITHUB_OUTPUT"
+                exit 0
+              fi
+              echo "::error::git push of the version bump failed and origin/main has not moved; check the token, rulesets and branch protection"
+              exit 1
             fi
           fi