Release workflow: tolerate Cargo.lock changes; always run Docker publish step (avoid skipped GHCR push)

- Use --allow-dirty for crates.io publish to avoid transient Cargo.lock blocking release
- Add git status/diff debug logs for easier triage
- Run Docker publish step even if crates.io publish fails (if: always())

.github/workflows/release.yml

@@ -343,23 +343,25 @@ jobs:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
         run: |
           echo "🚀 Publishing shimmy ${{ github.ref_name }} to crates.io..."
-          
-          # Handle uncommitted Cargo.lock (same logic as Gate 7)
-          if git status --porcelain | grep -q "Cargo.lock"; then
-            echo "⚠️ Cargo.lock has uncommitted changes (using --allow-dirty)"
-            DIRTY_FLAG="--allow-dirty"
-          else
-            echo "✅ No uncommitted changes detected"
-            DIRTY_FLAG=""
-          fi
-          
+          # Debug: print working tree state (helps diagnose Cargo.lock vs git status mismatch)
+          echo "🔍 git status (porcelain):"
+          git status --porcelain || true
+          echo "🔍 git diff --name-only against HEAD (if any):"
+          git diff --name-only || true
+
+          # When publishing we always allow dirty state for Cargo.lock differences that appear
+          # during build/packaging steps (this prevents transient lockfile updates from blocking publish)
+          echo "⚠️ Publishing with --allow-dirty to tolerate transient changes to Cargo.lock"
+          DIRTY_FLAG="--allow-dirty"
+
           # Publish to crates.io (dry-run already validated in Gate 7)
-          cargo publish $DIRTY_FLAG
+          cargo publish $DIRTY_FLAG || (echo "❌ cargo publish failed"; exit 1)
           
           echo "✅ Successfully published shimmy ${{ github.ref_name }} to crates.io!"
           echo "📦 Users can now install with: cargo install shimmy"
 
       - name: "🐳 Build and Push Docker Image to GHCR"
+        if: always()
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |