Stop the stable cut counting its own check runs against the commit it cuts (GST-2463) (#4297)

* Stop the stable cut counting its own check runs against the commit it cuts (GST-2463)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* Match the stable cut's own check runs by job, not by check suite (GST-2463)

GitHub files a check run another workflow creates through the API (main-backstop from release-gate.yml and evals-main-backstop.yml) under any github-actions check suite on the commit, so suite membership could hide a red main-backstop. The cut now lists the jobs of its own workflow runs and sets aside only check runs whose id is one of those job ids.

Review-Finding: p1/red-team#1 reader=red-team
Review-Finding: p1/adversarial-native#1 reader=adversarial-native
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* Say that the stable cut's own-run lookup needs actions: read and fails safe (GST-2463)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

---------

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

docs/releases.md

@@ -46,7 +46,13 @@ regression fix (below).
 it has completed and none failed, and `refs/notes/gstack-trains` holds no
 active freeze. A cancelled check run counts as red. A commit with a check run
 still going is skipped and the next older one is considered, back through 7
-days or 200 first-parent commits. The workflow runs no tests and no paid evals
+days or 200 first-parent commits. The cut's own job lands a check run on
+main's head, the very commit it may cut, so check runs from this workflow's
+own runs (its file path, `.github/workflows/weekly-release.yml`, matched
+by the job ids of those workflow runs) are set aside whether running or
+failed; every other check run counts as above. The lookup needs the
+workflow's `actions: read` permission; when it cannot read those runs, nothing
+is set aside. The workflow runs no tests and no paid evals
 of its own; it only reads what the trains, the backstop and the release gate
 already recorded.
 With nothing green in the window it fails and lists why each commit was