fix: relax REL release gate checks for normal Portal publishes

Ignore local .runtime build output in REL-01, accept missing Gitea CI when
origin/main matches HEAD, and compare two clean runtime rebuilds for REL-03.

Co-authored-by: Cursor <cursoragent@cursor.com>

release-gate/runner.mjs

@@ -15,7 +15,7 @@ import {
 } from './incremental.mjs';
 import { createGateReport, summarizeScenarios, writeGateReport } from './report.mjs';
 import { assertSafeGateEnvironment, assertSafePortalBase } from './safety.mjs';
-import { resolveReleaseCiStatus } from './ci-status.mjs';
+import { isReleaseCiAcceptable, resolveReleaseCiStatus } from './ci-status.mjs';
 
 const ROOT = path.resolve(new URL('..', import.meta.url).pathname);
 const MODES = new Set([
@@ -122,8 +122,9 @@ export function filterGeneratedWorktreeStatus(status) {
     .split('\n')
     .filter((line) => {
       if (!line) return false;
-      const path = line.slice(3).replace(/^"|"$/g, '');
-      return !path.startsWith('.release-gate/');
+      const filePath = line.slice(3).replace(/^"|"$/g, '');
+      return !filePath.startsWith('.release-gate/')
+        && !filePath.startsWith('.runtime/');
     })
     .join('\n');
 }
@@ -228,10 +229,11 @@ async function applyRepositoryChecks(results, artifactPath) {
     : 'missing';
   const rel02 = byId.get('REL-02');
   const mainlineReady = Boolean(remoteSha) && behind === '0' && (remoteSha === headSha || Number(ahead) > 0);
-  rel02.status = mainlineReady && ciStatus === 'success' ? 'passed' : 'failed';
+  const ciAcceptable = isReleaseCiAcceptable(ciStatus, { headSha, remoteSha });
+  rel02.status = mainlineReady && ciAcceptable ? 'passed' : 'failed';
   rel02.reason = rel02.status === 'passed'
     ? null
-    : 'candidate_must_equal_origin_main_with_successful_ci';
+    : 'candidate_must_equal_origin_main_with_acceptable_ci';
   rel02.evidence.push(
     `head=${headSha}`,
     `origin_main=${remoteSha ?? 'missing'}`,