fix(version-gate): run the head release tool with a bare env, drop outputs it must rewrite, prune the staging worktree

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

docs/ship-policy.md

@@ -173,10 +173,12 @@ unstamped when `VERSION` and `package.json`'s version match its merge base, the
 CHANGELOG change is confined to `[Unreleased]`, and any changed release output
 is byte for byte what `release_tool` generates at the base's `VERSION`, so a
 generator change ships with its regenerated output and the slot's restamp
-regenerates it again. A release output that differs from that (a hand edit, or
-one generated at a bumped version), a `VERSION` bump or a `package.json`
-version change classifies the head as stamped, and it must then carry base +
-bump. A `release_tool` that fails at the head is an error, never a pass.
+regenerates it again. A release output that differs from that (a hand edit, one generated at a
+bumped version, or one the tool never writes), a `VERSION` bump or a
+`package.json` version change classifies the head as stamped, and it must then
+carry base + bump. The tool runs as head code in a throwaway worktree with a
+bare environment and no tokens; one that fails at the head is an error, never
+a pass.
 
 It refuses (`QUEUE_NOT_READY`) when the working tree has tracked edits, HEAD
 is not the PR's pushed head, CI at that exact head is not green, or the pregate