#447 Fix auto-release static quality gate ratchet

Summary

• route release run-gates static-quality through the project ratchet (pnpm quality:static) instead of the raw 100%-default static-quality oracle
• add regression coverage so release automation cannot drift back to the raw static-quality-gate invocation
• address local Greptile feedback by rejecting explicit create IDs that normalize to a trailing dash
• document the fix and verification on recurring release-health item pm-7zs0

Verification

• node scripts/run-tests.mjs test -- tests/unit/commands/create-command.spec.ts tests/unit/scripts/release/run-gates.spec.ts tests/integration/release-automation-contract.spec.ts
• node scripts/release/run-gates.mjs --telemetry-mode off --skip-greptile
• pnpm lint
• pnpm changelog:pm:check (unchanged, pm-changelog 2026.6.30)
• pnpm audit --audit-level moderate
• pm health --check-only --summary --json
• pm validate --check-resolution --check-history-drift --json (history drift ok; known pre-existing validate_resolution_missing_fields:268)
• git diff --check
• GitHub Dependabot/code-scanning/secret-scanning open alert lists are empty

Notes

• Fixes the code-side root cause for scheduled Auto Release issue #432.
• Local Greptile CLI reused review id 9b1c26f0-48e0-4610-93bc-c8f3682638e6; its trailing-dash finding is implemented in this PR even though the CLI printed the cached comment again.

---

Summary by cubic

Routes the auto-release static-quality gate through the project ratchet by invoking pnpm quality:static, unblocking scheduled releases previously stopped by the 100% default threshold (release-health pm-7zs0). Also tightens create --id validation to reject IDs that normalize to a trailing dash.

• Bug Fixes
  • Auto-release run-gates now call pnpm quality:static instead of the raw static-quality script; unit and contract tests enforce and block regressions.
  • create now rejects explicit IDs ending with a dash after normalization.
  • Further hardened tests with regex-based gate contract assertions and guarded mocked spawn args to handle optional spreads.
  • Kept the recurring release-health reminder pm-7zs0 open so it remains visible in checks.