fix: repair RC release preflight

[piotr-blue]

Problem

The RC workflow failed before build and publication because
verify-release-readiness.js required an untracked performance report that has
no producer in the repository.

The failed run created no release commit, tag, artifact publication, or GitHub
release. v3.1.0-rc.16 remains available.

Fix

• replace the missing-report dependency with deterministic RC metadata checks
• verify the prepared version, .cz.toml, branch, tag availability, and changed files
• add automated tests for the release preflight
• run release-tool tests in regular CI
• run full build, rcVerify, JMH compilation, binary compatibility, and source-archive verification before tagging
• verify two source archive builds are byte-for-byte identical
• delay the release commit and tag until every verification gate passes
• add the rc-release environment hook for optional approval protection

Verification

• release-tool tests: 7/7 passed
• ./gradlew rcVerify jmhClasses: passed
• source release rebuilt with identical SHA-256
• workflow YAML parsing: passed
• git diff --check: passed

Retry behavior

Merging this PR into next starts a fresh RC workflow. Do not rerun the previous failed job because it uses the broken workflow revision.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6625841d8f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Preserve the tag-recovery retry path

When a retry starts from next after the branch already contains the prepared .cz.toml version but the tag was not created or pushed (for example, a non-atomic git push ... --follow-tags updated the branch ref and rejected the tag), prepare-rc-release.js computes the same RC version and leaves nothing staged. Because this line no longer permits an empty release commit, the workflow fails here before it can recreate the missing tag; either require/advance a changed .cz.toml or keep the empty-commit fallback for that recovery case.

Useful? React with 👍 / 👎.