Stop the stable cut counting its own check runs against the commit it cuts (GST-2463) (#4297)

* Stop the stable cut counting its own check runs against the commit it cuts (GST-2463)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* Match the stable cut's own check runs by job, not by check suite (GST-2463)

GitHub files a check run another workflow creates through the API (main-backstop from release-gate.yml and evals-main-backstop.yml) under any github-actions check suite on the commit, so suite membership could hide a red main-backstop. The cut now lists the jobs of its own workflow runs and sets aside only check runs whose id is one of those job ids.

Review-Finding: p1/red-team#1 reader=red-team
Review-Finding: p1/adversarial-native#1 reader=adversarial-native
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* Say that the stable cut's own-run lookup needs actions: read and fails safe (GST-2463)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

---------

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

.github/workflows/weekly-release.yml

@@ -77,6 +77,8 @@ jobs:
       contents: write
       # Reads the candidate's check runs.
       checks: read
+      # Finds this workflow's own runs on the candidate, whose check runs the gate sets aside.
+      actions: read
       # A security or regression cut reads the label on the #<n> its reason names.
       issues: read
       pull-requests: read
@@ -143,6 +145,7 @@ jobs:
     permissions:
       contents: read
       checks: read
+      actions: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with: