emrg: the release chain runs the agent-prompt assertion, and nothing pins that it does #2411

scripts/check-release-prompt.py (#2401) is wired into build-release.yml's release job and its own behaviour is
well pinned — 14 tests over all three exit codes, four subject shapes and both wrong answers. What is pinned nowhere
is that the release job runs it.

Measured

• tests/test_check_release_prompt.py contains no reference to the workflow at all (grep workflow → nothing).
• The sibling guard has exactly those pins: tests/test_check_release_artifact_version.py reads
  jobs.release.steps and asserts the step's body (_step_body()), that it is ordered
  download-artifact → step → Create GitHub Release, and that it needs no uv and no network.
• So today the prompt step can be deleted, renamed, moved after publication, or changed to skip silently when
  no artifact is present — the family issue emrg: the macOS release steps report success when the pkg is absent, so a release can ship without it #1913 fixed for the three macOS steps — and the suite stays green.
• An execution gap of exactly this shape was observed on the real chain: the v0.3.22 release job (run
  39373994491) ran Assert the artifacts declare the version the tag names and then went straight to
  Create GitHub Release — the prompt step was absent, because the tag was cut before emrg: the release chain reads the shipped prompt out of the artifact #2401 landed. Nothing in the
  repository could have reported that; it took reading the run's step list.

What must change

Add the workflow-side pins for this step to tests/test_check_release_prompt.py, in the shape the sibling already
uses — read the parsed job, never a copy of the text kept in the test:

1. a step in jobs.release.steps exists whose run: invokes python3 scripts/check-release-prompt.py.
2. it runs after actions/download-artifact and before Create GitHub Release — a mismatch found after
   publication is a host-side incident, found before it is a re-run.
3. its run: block mentions no uv — the release job installs nothing, so a uv run there would fail the build.
4. the step's own run: block, executed under bash in a temporary tree, refuses when artifacts/ holds no
   EMRG-*-linux-*.tar.gz: non-zero exit and an ::error:: line naming the pattern; and with a matching file
   present it does not print that refusal (a guard that refuses everything is not measuring its subject).

Acceptance

Each item is checkable by running one command, and none needs the host to judge it:

• uv run --no-sync pytest tests/test_check_release_prompt.py -q passes with the pins present.
• Deleting the step, renaming it, or moving it after Create GitHub Release makes the file fail.
• Replacing the step's empty-candidate branch with a silent exit 0 makes the file fail.

Origin: issue filed from this cycle's reading of the release chain, not from a rant — no host message is quoted.