ci: gate releases on main commit, fail loudly on stale snapshot