feat: add guarded portal canary release

scripts/check-release-ready.sh

@@ -53,9 +53,16 @@ case "${branch}" in
     ;;
 esac
 
-if [[ -n "$(git -C "${ROOT}" status --porcelain=v1 --untracked-files=all)" ]]; then
+# The runtime builder intentionally strips this legacy tracked content from the
+# source-free artifact. The complete Gate applies the same narrow exception.
+relevant_status="$(
+  git -C "${ROOT}" status --porcelain=v1 --untracked-files=all -- \
+    . \
+    ':(exclude).runtime/portal/public/plaza-covers/**'
+)"
+if [[ -n "${relevant_status}" ]]; then
   echo "Release check failed: worktree has uncommitted or untracked changes." >&2
-  git -C "${ROOT}" status --short --untracked-files=all >&2
+  printf '%s\n' "${relevant_status}" >&2
   exit 1
 fi