fix(ci): stop SDK publish after native cancel

[Lythaeon]

Description

Stop TypeScript SDK release workflows from publishing the SDK after native publish jobs were manually cancelled. This closes the current release control gap where publish-sdk could keep running and polling npm even after the native matrix had been cancelled.

Changes

Detailed list of what changed:

• .github/workflows/release-typescript-sdk.yml: added actions: read so the workflow can inspect its own job conclusions through the Actions API
• .github/workflows/release-typescript-sdk.yml: tightened the publish-sdk job gate from always() to !cancelled()
• .github/workflows/release-typescript-sdk.yml: added a native job conclusion check before SDK install/wait/publish
• .github/workflows/release-typescript-sdk.yml: updated the npm indexing wait loop to stop early when any native publish job is cancelled
• .github/workflows/release-typescript-sdk.yml: preserved the existing partial-success behavior for native failures, but no longer treats explicit cancellation as eligible for SDK publish

For slice-related changes, include:

• Affected slices: CI / release automation only
• Cross-slice communication changes (if any) and why: none
• Migration requirements (if any): none

Motivation

Business motivation:

• Avoid wasting release CI minutes and avoid publishing the top-level SDK from a partially cancelled release run.

Technical motivation:

• publish-native uses continue-on-error: true, so publish-sdk was still allowed to run.
• The wait loop only polled npm visibility and had no awareness of upstream job cancellation state.

Alternative approaches considered:

• Relying on workflow-run cancellation only. Rejected because users may cancel matrix jobs directly and expect downstream publish to stop.

Scope and impact

• Affected slices: GitHub Actions release workflow for the TypeScript SDK
• Data/API changes: none
• Backward compatibility: no user-facing SDK/API change
• Performance impact: fewer wasted release minutes in cancelled runs
• Security impact: none beyond adding read access to Actions metadata for the workflow itself

Testing

• Unit tests
• Integration tests
• Manual verification
• Performance checks (if applicable)
• Security checks (if applicable)

Commands/results:

python - <<'PY'
import yaml
from pathlib import Path
with Path('.github/workflows/release-typescript-sdk.yml').open() as f:
    yaml.safe_load(f)
print('yaml-ok')
PY

act workflow_dispatch -W .github/workflows/release-typescript-sdk.yml -j publish-sdk -n

bash -n <<'EOF2'
# validated the updated wait-loop shell logic parses cleanly
EOF2

Related issues and documentation

• Fixes:
• Related: TypeScript SDK release rerun control after cancelled native publish jobs
• Architecture docs: docs/architecture/README.md
• Relevant ARD/ADR:
• Operations/runbook updates:

Reviewer checklist

• Code follows project standards and architecture constraints
• Slice boundaries are respected (docs/architecture/ard/0003-slice-dependency-contracts.md)
• Tests added/updated and passing
• Documentation updated (README/docs/operations as needed)
• No undocumented breaking change
• Performance trade-offs documented where relevant
• Security considerations addressed where relevant

Additional notes

This change only affects release control flow. It does not change package contents or publish order when all native jobs run normally.