[kvlonge]

Why

Releases spent most of their time rebuilding things that had already been checked. Release pull requests reran every Verify suite for version-only changes, compiled the workspace just to refresh Cargo.lock, and Publish rebuilt every wheel from scratch. The release performance gate also blocked release pull requests instead of tracking main.

Changes

• Skip Verify's suites on Release Please pull requests that only change the manifest, changelog and version lines; the trusted release checks still post the required Verify status.
• Refresh Cargo.lock with cargo update --workspace and cargo metadata --locked instead of compiling.
• Move the wheel matrix, maturin settings and smoke tests into a reusable Build Distributions workflow used by Verify, a new Release Distributions check and Publish.
• Publish reuses a successful Release Distributions run only when its commit has exactly the release tag's tree; otherwise it builds from the tag.
• Extend the Performance Work guidance in AGENTS.md: native profiling, applicability and ceiling checks before building, output identity and measured-only claims.
• Run Release Performance on every push to main. A regression fails the run and opens or comments on a single performance-regression issue. The comparison keeps its exit status and diffs release files as text.

Verification

• Rebased onto main after ci: smoke test the published wheel through the current native catalogue entry point #1131; the reusable build keeps its semantic_help_catalogue() smoke test.
• Independent read-only review of the workflow changes; findings fixed in the follow-up commits.
• make check-ci and the public-repository scanner pass locally.
• Release-path workflows only run on release pull requests, tags and main pushes, so the next release exercises them end to end.