Release-stopping checks: over-budget runtimes and missing entries #4924

Release-stopping checks: those whose p95 runtime is over half their time limit, plus the gaps found while classifying them into entries.

• guard-tree section: the step runs at about 84% of its limit and was killed at the limit several times on 2026-10-08. Tracked in fix(guards): a hung guard is killed and named; leaked fake serves reaped; push-reuse mutants in parallel (0.71 row 25) #4921.
• clean-room workflow (paiml/infra clean-room.yml): p95 is 181 min over its last 100 completed runs, against the 360-min default (no timeout-minutes set), which is 50.3%. 6 of those 100 runs failed and then passed on the same head sha.
• Nothing scans the published crate tarballs for secrets or unintended files. rc_publish_gate.sh only proves that they package and compile. A content check is missing.
• scripts/release/release_ready.sh (without --gates) exits 2 on main @ ad8fafc: unparsed call form at scripts/release/autopilot.sh:76, so the surface report reads not_measured.
• x86-main's early steps (fmt, falsification-ID order, guard case tables, fat_driver self-test, secret-plumbing guard) can stop a merge, but no row in the release-ready list names them.

Agent: aprender-a7