Let Auto Release wait for the full authoritative CI run before failing #289

Problem

Auto Release can't finish its own changelog PR. .github/scripts/verify-authoritative-run.sh waits for the dispatched CI run with timeout 60m gh run watch …. That CI run's Mutation Testing job takes over two hours (its timeout-minutes is 300). So the release job fails after about an hour with "stopped before a successful Quality Gate", even when the run later passes. The changelog PR stays open until someone merges it by hand and reruns Auto Release.

Evidence

• v0.23.17: Auto Release run 42749194628, attempt 1, release job started 03:24:09Z and failed at 04:27:26Z: PR https://github.com/hemsoft-dev/gh-x/pull/288 expected head c8e57bb4… authoritative run 42749557067 stopped before a successful Quality Gate.
• The same authoritative run's Mutation Testing ran 03:27:26Z to 05:43:01Z (2 h 16 min), and its Quality Gate passed at 05:43:07Z, 76 minutes after the watch gave up.
• Recovery each time: merge the docs PR by hand, then rerun Auto Release. Attempt 2 takes the "CHANGELOG.md already records published vX" path. Done for docs: record v0.23.17 release #288 (attempt 2 of run 42749194628 passed).
• Mutation Testing took 2 h 15 min to 2 h 55 min on 10 PR runs measured on 2026-11-07 (docs: correct atm and changelog defaults in README #283), so the 60-minute window can't pass on any release.

Acceptance criteria

• The Auto Release wait for the authoritative CI run covers at least the Mutation Testing job's timeout-minutes plus the other gates, or Auto Release hands off cleanly (for example, it queues auto-merge and exits successfully, leaving merge to the existing guarded path) instead of failing.
• A release whose authoritative CI run passes after more than 60 minutes ends with the release job green and the changelog PR merged, with no manual merge and no rerun.
• The job-level limits stay consistent: the release job's own timeout can't be shorter than the new wait.
• go test ./.github/scripts/... and the ruleset/workflow consistency check still pass. Any test covering verify-authoritative-run.sh is updated.

Validation

1. Check the wait bound in the script against timeout-minutes for mutation in .github/workflows/ci.yml.
2. On the next real release, confirm the Auto Release run's first attempt is green and the chore/changelog-* PR merged without a rerun.