ci: add bounded complete release gate

.github/workflows/headless-portability.yml

@@ -78,10 +78,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
-      - name: Install .NET 10
+      - name: Install pinned .NET SDK
         uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: "10.0.x"
+          global-json-file: global.json
 
       # No apt step here on purpose. This job's whole claim is that the closure
       # below is presentation-free: it builds Bake, Plugin.Abstractions, Core,
@@ -159,10 +159,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
-      - name: Install .NET 10
+      - name: Install pinned .NET SDK
         uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: "10.0.x"
+          global-json-file: global.json
 
       - name: Build and test the portable launcher
         shell: pwsh
@@ -231,10 +231,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
-      - name: Install .NET 10
+      - name: Install pinned .NET SDK
         uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: "10.0.x"
+          global-json-file: global.json
 
       - name: Build and publish Linux graphical client
         shell: pwsh
@@ -324,10 +324,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
-      - name: Install .NET 10
+      - name: Install pinned .NET SDK
         uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: "10.0.x"
+          global-json-file: global.json
 
       - name: Install lavapipe, the Vulkan loader and Xvfb
         shell: bash

.github/workflows/release-gate.yml

@@ -0,0 +1,38 @@
+name: Complete Release gate
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  complete-release:
+    name: Complete Release suite (Windows)
+    runs-on: windows-latest
+    timeout-minutes: 45
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install pinned .NET SDK
+        uses: actions/setup-dotnet@v4
+        with:
+          global-json-file: global.json
+
+      - name: Run complete bounded Release gate
+        shell: pwsh
+        run: ./tools/run-release-gate.ps1
+
+      - name: Upload Release gate evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-gate-${{ github.run_id }}-${{ github.run_attempt }}
+          if-no-files-found: error
+          retention-days: 14
+          path: artifacts/release-gate/