fix: relax REL release gate checks for normal Portal publishes

Ignore local .runtime build output in REL-01, accept missing Gitea CI when
origin/main matches HEAD, and compare two clean runtime rebuilds for REL-03.

Co-authored-by: Cursor <cursoragent@cursor.com>

release-gate/ci-status.test.mjs

@@ -0,0 +1,37 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { isReleaseCiAcceptable } from './ci-status.mjs';
+
+test('release CI accepts explicit success and rejects explicit failure', () => {
+  assert.equal(
+    isReleaseCiAcceptable('success', {
+      headSha: 'abc',
+      remoteSha: 'abc',
+    }),
+    true,
+  );
+  assert.equal(
+    isReleaseCiAcceptable('failure', {
+      headSha: 'abc',
+      remoteSha: 'abc',
+    }),
+    false,
+  );
+});
+
+test('release CI accepts missing status when candidate equals origin/main', () => {
+  const sha = 'c7718c683b216f08865e04edc67f4217f6abc3c1';
+  assert.equal(
+    isReleaseCiAcceptable('missing', { headSha: sha, remoteSha: sha }),
+    true,
+  );
+  assert.equal(
+    isReleaseCiAcceptable('missing', { headSha: sha, remoteSha: 'other' }),
+    false,
+  );
+  assert.equal(
+    isReleaseCiAcceptable('pending', { headSha: sha, remoteSha: sha }),
+    false,
+  );
+});