#20331 ci: publish a new RC line instead of refusing it as stale

Summary

The 0.65.2 RC was built, signed and notarized, but it never reached the RC feed. The feed still serves 0.65.0-rc.

The publish job of auto-resume-nightly-notarization.yml (run 38372915695) failed with source continuation is older than the published release; refusing stale replacement. Since #18553 (Oct 8), the job requires the published commit to be an ancestor of the new source commit. Each RC line is a new rc/vX.Y.Z branch cut from main, so the published 0.65.0 RC commit (on rc/v0.65.0) is never an ancestor of rc/v0.65.2. Every new RC line fails this check.

RC build numbers come from GITHUB_RUN_ID and only grow. The build-number check just before the ancestor check already refuses an older RC. The ancestor check now runs for nightly only.

Verification

• actionlint on the workflow: the same 18 existing shellcheck notes as main, no new ones.
• tests/test_nightly_publication_marker.py, test_nightly_resume_tracks.py, test_nightly_artifact_alias.py and test_nightly_notarization_poll_loop.py pass (run with PyYAML through uv).
• After the merge, the next rc/v0.65.2 push (the sign-in fix, #20270) runs the RC publish path.

Changelog

none

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the RC publish path so a new RC line (e.g. 0.65.2) can be released instead of being refused as stale. Each RC line is cut from main, so the published commit of a previous RC is never its ancestor; the build-number check already rejects older RCs, so the ancestry check now runs for nightly only.

• RC lines compare MARKETING_VERSION instead of ancestry, refusing a source older than the published RC so a later push to an older RC branch cannot replace a newer line.
• RC release notes collect from the merge base of the two lines when their compare diverges, and include PRs merged to both the RC branch and main.

Summary by CodeRabbit

• Bug Fixes
  • RC releases now check that version information is available and that the source version is not older than the published version before proceeding.
  • RC release notes now include relevant merged changes from both the RC branch and main, and can account for diverged commit histories when comparing changes.
  • Publication checks for other release channels continue to prevent publishing from a source that does not include the published commit.