PR-bound image release gates must run before merge
Observed 2026-09-08 in e3-solutions/theft while checking COR-4082 / PR #805. The PDF417 GHCR publication workflow is a one-shot pull_request:labeled gate bound to an exact PR number and head SHA. PR #805 was squash-merged before the publication label ran, leaving neither its revi…