Prevent stale release approvals from blocking newer runtimes

[UnArbosFive]

Summary

• Preserve the existing mainnet environment approval and everything it currently authorizes: branch mirroring, GitHub release promotion, Docker dispatch, package publication, and production docs deployment.
• Replace the workflow-wide queue with a runtime-specific release slot so an unanswered approval for an older runtime cannot block a newer runtime.
• Cancel superseded waiting publication runs, while never interrupting a job that has started executing.
• Suppress duplicate release and wheel-build work when another watcher already owns the same runtime slot.
• Revalidate the finalized runtime spec and exact code hash immediately after approval, before changing the mainnet mirror or GitHub release.

Why

Runtime v442 executed on chain, but its watcher remained at the separate publication approval. The workflow-wide concurrency lock then prevented the v443 watcher from reaching its own approval. This keeps the two-approval security model while removing that cross-runtime failure mode.

This PR targets the release-444 branch from #3058 and requires normal review before any behavior changes land.

Test plan

• .github/scripts/test-cancel-superseded-release-watchers.sh
• bash syntax checks for the new scripts
• YAML parse checks for both modified workflows
• git diff --check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
subtensor	Ready	Preview	Aug 6, 2026 5:03pm