ci(release): let a later green ci-ok supersede a red run on the same commit

Both release workflows refused a commit if any ci-ok check run on it was
not green. Every workflow run is its own check suite, so a red run stays
on the commit after a later one passed: a flaky job on the dev push, or a
push run cancelled by a manual run on the same ref (ci-ok runs with
always() and fails on the cancelled jobs). Running Tests & SonarQube
again, as the error told the maintainer to do, added a green suite but
never cleared the red one, and the message did not say which run was
red.

The gate now lives in scripts/ci/ci-ok-verdict.mjs. It fetches every
attempt (filter=all), keeps the newest attempt per check suite, refuses
while one is still going and requires the run that finished last to be
green. It prints the link of every run it counted, and an older red run
it overrode shows up as a notice. A response it cannot read, one cut off
by pagination or a run without a suite, conclusion or completion time
fails the release instead of passing it. Tests run with test:ci-scripts.

.github/workflows/docker.yml

@@ -62,28 +62,20 @@ jobs:
           fetch-tags: true
           token: ${{ steps.app-token.outputs.token }}
 
-      # Every check run named ci-ok on this commit (the dev push and the main
-      # push each leave one) has to have finished green. A run still going
-      # counts as not green: wait for it and dispatch again.
+      # The dev push, the main push and any manual run each leave a ci-ok on
+      # this commit. scripts/ci/ci-ok-verdict.mjs counts the newest attempt of
+      # each, refuses while one is still going, and requires the one that
+      # finished last to be green, so a later green run supersedes a flaky or
+      # cancelled one. It prints the link of every run it counted.
       - name: Require a green ci-ok on the commit being released
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           sha="$(git rev-parse HEAD)"
-          conclusions="$(gh api "repos/$GITHUB_REPOSITORY/commits/$sha/check-runs?check_name=ci-ok&per_page=100" \
-            --jq '[.check_runs[] | .conclusion // "pending"] | join(" ")')"
-          echo "ci-ok on $sha: ${conclusions:-none}"
-          if [ -z "$conclusions" ]; then
-            echo "::error::ci-ok never ran on $sha. Run Tests & SonarQube on main and dispatch again."
-            exit 1
-          fi
-          for c in $conclusions; do
-            if [ "$c" != "success" ]; then
-              echo "::error::ci-ok on $sha is not green ($conclusions)."
-              exit 1
-            fi
-          done
+          runs="$RUNNER_TEMP/ci-ok-runs.json"
+          gh api "repos/$GITHUB_REPOSITORY/commits/$sha/check-runs?check_name=ci-ok&filter=all&per_page=100" > "$runs"
+          node scripts/ci/ci-ok-verdict.mjs "$runs" "$sha"
 
       - name: Determine bump type and update version
         id: bump