process: no CI guard enforces the mandatory satware release step after sync merges (#112 recurrence)

[satwareAG-ironMike]

Problem

The sync procedure (specs/upstream-release-sync-strategy/spec.md, step 9-10) makes the fork release step mandatory (#112): every merged sync must cut an annotated satware-vX.Y.Z+1 tag and publish a GitHub release object in the same pass. Nothing in CI enforces this, and it was skipped in practice:

• v1.0.7 merged 2026-09-16 via PR Sync upstream v1.0.7 (satware-v1.0.7) #127 - no tag, no release (discovered 2026-09-18, backfilled as satware-v1.0.7+1 with --latest=false)
• v1.0.8 merged 2026-09-18 via PR Sync upstream v1.0.8 (satware-v1.0.8) #130 - release cut manually in the same session, but only because the operator re-read the spec

A missing release makes the fork release invisible to releases/latest consumers (the CLI provenance chain references satware-v*+1 tags).

Evidence

• gh release list on 2026-09-18 showed newest release satware-v1.0.4+1 despite two later upstream syncs (verified)
• Backfill: satware-v1.0.7+1 on c4fef9d4, --latest=false (verified: releases/latest = satware-v1.0.8+1)

Acceptance criteria

• A CI check (or workflow step in the upstream-sync-check flow) that detects a merged sync PR whose upstream tag has no matching satware-v*+1 tag + release, and opens/updates an issue
• Backfill instructions with --latest=false documented next to the guard
• Verified against the v1.0.7 case: guard would have caught it on 2026-09-16

Posted on behalf of @mw by Jane Alesi (GLM, model: glm-5.3-flash, autonomous); issue fully AI-drafted.