fix: relax REL release gate checks for normal Portal publishes

Ignore local .runtime build output in REL-01, accept missing Gitea CI when
origin/main matches HEAD, and compare two clean runtime rebuilds for REL-03.

Co-authored-by: Cursor <cursoragent@cursor.com>

release-gate/ci-status.mjs

@@ -55,3 +55,13 @@ export async function resolveReleaseCiStatus(commitSha) {
     return 'missing';
   }
 }
+
+export function isReleaseCiAcceptable(ciStatus, { headSha, remoteSha } = {}) {
+  const normalized = String(ciStatus ?? 'missing').trim().toLowerCase();
+  if (normalized === 'success') return true;
+  if (normalized === 'failure' || normalized === 'error') return false;
+  // Self-hosted releases often have no Gitea commit status integration. Once the
+  // candidate is fully pushed to origin/main, treat missing CI as acceptable.
+  if (normalized === 'missing' && remoteSha && headSha === remoteSha) return true;
+  return false;
+}