fix(release): the console job could never have claimed the name it exists to claim

[wshallwshall]

Blocks the first webconsole-v* tag. As main stands, release-webconsole would fail before its
publish step, so the tag would claim nothing and burn the release.

The defect

release-webconsole used a bare gh release upload, copied from release-harness. The harness can do
that only because needs: release guarantees the engine already created the GitHub release. The
console deliberately has no needs — it fires on its own tag namespace — so on a webconsole-v* tag
no release exists, the upload fails with "release not found", and the job dies before the
publish step. The one job whose purpose is to create the PyPI project and claim
messagefoundry-webconsole could never have claimed it.

Now create-or-update, mirroring the engine. The update arm is load-bearing for a second reason this
workflow already documents: on v0.3.1 a bare gh release create turned a single PyPI failure into a
permanent retry deadlock — every re-run died there and skipped the publish, so a re-run could not
test the fix it existed to verify. Notes come from the console's own changelog; the step order
(reversible GitHub release before irreversible PyPI upload) matches the engine deliberately.

The guard did not work when written

Two derived guards were added with it:

• test_a_job_without_needs_release_must_create_its_own_github_release — any release job that attaches
  assets without depending on the engine release must create its own.
• test_every_release_creating_job_is_rerunnable — every gh release create needs a matching
  gh release view guard, or the v0.3.1 deadlock returns.

Mutation-testing caught that the first stayed GREEN when the console was reverted to a bare upload
— it did not catch the exact defect it was written for. Two causes, both fixed:

1. Job chunks were sliced with body.index(f"{name}:"), which matches the earliest substring
   anywhere including header prose, so every chunk began at the top of the file and contained every
   job. Chunks are now line-anchored on ^ <name>:.
2. The chunk was matched against raw text — and the job's own comment explaining the v0.3.1 deadlock
   contains the literal gh release create, so it read as "creates a release" with the command deleted.

Both guards now read through a shared _executed_shell() that strips comment lines: count executed
shell, never narration. That helper exists precisely because the same comment-counting bug was fixed
in one guard and not the other.

All four mutations now red: bare upload · drop the re-run arm · let the engine fire on a console tag ·
couple the cadences with needs: release.

Verification

9442 passed. The single failure (test_installed_metadata_matches_dunder_version) is a local-venv
artifact — this worktree has no .venv, so the run used a stale 0.3.0 install against 0.3.2
source; it passes on a fresh CI install.

Nothing here changes what a tag does until PUBLISH_WEBCONSOLE=true.

🤖 Generated with Claude Code