fix(release): run native builds and canary smoke after skipped channels (#16149)

## Thinking Path

> - Paperclip lets people manage AI agents for work.
> - Published packages need the native runner artifacts from their exact
source.
> - The release workflow selects one channel and deliberately skips the
other channels.
> - The native producer used an implicit success condition across those
skipped dependencies.
> - The merged-source release selected native artifacts but skipped
their build and canary publication.
> - This pull request makes the existing producer and canary smoke
conditions explicit.
> - Successful source selection, artifact verification and cancellation
checks still apply.

## Linked Issues or Issue Description

Refs #16028.

**What happened?**

[Release
38389963483](https://github.com/paperclipai/paperclip/actions/runs/38389963483)
passed source selection, then skipped native production, canary
publication and onboarding smoke. The exact source script requires
native artifacts; the API does not expose the source job outputs. The
registry canary still points to an older source.

**Expected behavior**

The selected release channel builds its required native artifacts,
publishes its verified package, then runs the exact-version onboarding
smoke. Skipped inactive channels must not suppress these jobs.

**Steps to reproduce**

Inspect the linked master-push run at
`d67e3507b23041212fa26302ce6de078c5ebcc05`. Compare the successful
source job and exact source script with the three skipped jobs. The two
existing workflow contract cases also fail against the original
conditions.

**Paperclip version or commit**

`d67e3507b23041212fa26302ce6de078c5ebcc05`.

**Deployment mode**

GitHub Actions release workflow.

## What Changed

- Require `!cancelled()`, successful source selection and
`required=true` for native production.
- Require `!cancelled()` and successful publication for canary
onboarding smoke.
- Extend the existing workflow tests for selected channels, skipped
ancestors, missing outputs, failed jobs and cancellation.

## Verification

- The two affected contract cases fail before treatment and pass after
treatment.
- Focused source controls cover 28 producer and five smoke condition
combinations.
- Independent source review found no changes to source, trust, artifact,
channel, permission or publication gates.
- These tests check source predicates. Actual hosted routing and
publication must still pass after merge.
- Full existing release suite: 70/70 pass. Existing source-verification
neighbors: 20/20 pass.
- Workflow structure passes actionlint. Full shell lint reports five
hints in unchanged commands.
- Full hosted checks and fresh Greptile review are pending.

## Risks

The producer serves all release channels. The explicit source-result and
required-output checks retain each channel's admission gates.
Cancellation still prevents new work. This does not change runtime code,
packages, agent selection, or stored configurations. [GitHub documents
the implicit status
check](https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#status-check-functions)
and [skipped dependency
behavior](https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-jobs).

## Model Used

OpenAI Codex, based on GPT-6, with reasoning and code tools. This
session does not expose a verifiable exact model ID or context window
size.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

Co-authored-by: Paperclip <noreply@paperclip.ing>

.github/workflows/release.yml

@@ -377,7 +377,7 @@ jobs:
 
   release_runner_binaries:
     needs: release_runner_source
-    if: needs.release_runner_source.outputs.required == 'true'
+    if: ${{ !cancelled() && needs.release_runner_source.result == 'success' && needs.release_runner_source.outputs.required == 'true' }}
     uses: ./.github/workflows/release-verify.yml
     with:
       ref: ${{ needs.release_runner_source.outputs.sha }}
@@ -525,7 +525,7 @@ jobs:
   # anyone mistakes an installable package for an onboardable one.
   smoke_canary_onboarding:
     needs: publish_canary
-    if: needs.publish_canary.result == 'success'
+    if: ${{ !cancelled() && needs.publish_canary.result == 'success' }}
     runs-on: ubuntu-latest
     timeout-minutes: 20
     permissions: