ci: add bounded complete release gate

docs/release-gate.md

@@ -0,0 +1,41 @@
+# Complete Release gate
+
+The default release gate is repository-owned and uses the SDK feature band in
+`global.json`:
+
+```powershell
+pwsh ./tools/run-release-gate.ps1
+```
+
+The command restores and builds `AcDream.slnx`, discovers every project under
+`tests/` that declares `Microsoft.NET.Test.Sdk` or `IsTestProject`, verifies
+that the solution includes it, and runs each test assembly once in a fresh
+Release process. It does not retry failures.
+
+Each restore, build, and test process has an outer hard timeout. Every test
+also runs with VSTest blame-hang enabled: after three minutes in one test, the
+test host is terminated and a mini dump is collected; after ten minutes, the
+outer watchdog kills the complete `dotnet test` process tree. CI additionally
+has a 45-minute job bound.
+
+Evidence is written to `artifacts/release-gate/`:
+
+- `release-gate-summary.json` records the commit, branch, worktree state, SDK,
+  RID, bounds, process outcomes, assembly list, and
+  executed/passed/skipped/failed totals;
+- `environment.txt` records `dotnet --info`, configured NuGet sources, and the
+  discovered test-project set;
+- `test-results/` contains one TRX per assembly plus any VSTest hang sequence
+  and dump files;
+- `logs/` contains the exact command and complete output for every child
+  process; and
+- `SHA256SUMS.txt` hashes the evidence bundle.
+
+The complete gate runs on Windows because it exercises the full product and
+launcher surface. `.github/workflows/headless-portability.yml` remains the
+focused Windows/Linux portability and Vulkan evidence workflow; those jobs are
+not substitutes for the complete gate.
+
+Environment-dependent tests retain their current skip behavior and are counted
+explicitly in the JSON/TRX report. Classifying or replacing those tests belongs
+to R3, not to this gate checkpoint.