release.yml: restore always() on build-gate so a failed build goes red

A regression: replacing 'if: always()' with the bare content guard
'if: ${{ !(needs.build.result == '\''success'\'' && ... skip_tests == '\''true'\'') }}'
lost always() semantics. Because 'build' is in needs:, a FAILED build then
cascade-skips build-gate (GitHub's default: a dependent job is skipped when a
needs: dependency fails unless the if: contains always()/!cancelled()). That
left the REQUIRED build-gate check quietly pending on a real build failure
instead of going red (observed on run 33162860634, a push to main with a
failing build).

Restore always() so the gate runs for every build outcome and the narrow guard
alone decides the sole non-run case (a *successful* compile-only build, which
must stay pending/blocked, not red). A real build failure now runs the gate and
it exits 1 -> red. Documented why always() is required in the comment.

Assisted-By: Claude Opus 4.8

.github/workflows/release.yml

@@ -325,10 +325,17 @@ jobs:
   # A compile-only build that FAILED (build.result != success) still runs the
   # gate below and goes red, and the trivial-change skip still runs and goes
   # green — so docs-only PRs are not left pending forever.
+  #
+  # The always() is REQUIRED: without it, a FAILED build (a job listed in needs:)
+  # would cascade-skip this gate by GitHub's default rule, leaving the required
+  # check quietly pending instead of red. always() forces the gate to run for
+  # every build outcome so the guard alone — not the needs: cascade — decides
+  # whether it runs; the sole non-run case is the narrow successful-compile-only
+  # one above. (A real build failure then runs the gate and it exits 1 → red.)
   build-gate:
     permissions: {}
     needs: [changes, build]
-    if: ${{ !(needs.build.result == 'success' && needs.build.outputs.skip_tests == 'true') }}
+    if: ${{ always() && !(needs.build.result == 'success' && needs.build.outputs.skip_tests == 'true') }}
     runs-on: ubuntu-latest
     steps:
       - run: |