Make immutable CLI release eligibility explicit and non-release merges green

[nia-sg-bot]

Why

The CLI test workflow passed for commit 592fbfd (PR #52), but the immutable-release workflow failed on 2026-09-11 because the merged resolving PR did not carry release:publish. A release workflow may fail closed, but ordinary non-release merges must not leave release health red or make the required label path ambiguous.

Acceptance criteria

• Define one documented, reviewable release-eligibility path for a merged CLI PR: linked same-repository roadmap issue, release:ready, release:publish, and exactly one semantic bump label.
• On a non-release-eligible merge, the workflow reports an explicit skipped / not eligible result rather than a failed release run.
• On an intended release, a missing prerequisite fails with a concise diagnostic that names the PR, missing label/link, and corrective action.
• Add workflow-level fixtures/tests for eligible patch/minor/major, no-release merge, missing release:publish, missing bump, and missing/invalid linked issue.
• Demonstrate one successful immutable tag created from a reviewed eligible merge and link it from the release notes/issue.
• Keep the existing fail-closed invariant: no tag is created when prerequisites are invalid.

Evidence

• Tests for PR feat(provenance): retain requested range refs #52 passed: https://github.com/WildestAI/DiffGraph-CLI/actions/runs/34560691067
• Release run failed: https://github.com/WildestAI/DiffGraph-CLI/actions/runs/34560733904
• Retained log: Resolving PR must carry release:publish.

Scope

This is release-roadmap machinery only; it does not change product graph semantics.