Release script refuses a release that can't be cut #157

Parent

#150

What to build

The release script refuses a release that can't be cut, before it pushes anything. It refuses when:

• the version isn't valid semver (plain X.Y.Z, no leading v)
• the version isn't strictly higher than the one in the manifest on origin/main
• a v<version> tag already exists, locally or on origin
• the latest CI run on origin/main didn't succeed

Each refusal gives a clear message on stderr, exits non-zero and leaves origin untouched: no branch, no PR, no tag.

The already-tagged case in #158 is a narrow exception to the tag refusal, and is handled there.

Acceptance criteria

• Bad semver (e.g. v0.4.0, 0.4, abc) is refused.
• A version equal to or lower than the one on origin/main is refused.
• An existing v<version> tag, local or on origin, is refused.
• A latest CI run on origin/main that is red or unfinished is refused.
• Each refusal exits non-zero with a message naming the reason, and origin has no new branch, PR or tag.
• The fake gh can report the latest CI run on a branch. Tests go through the same black-box seam as Release script: one command from version to pushed tag #156.

Blocked by

• Release script: one command from version to pushed tag #156