fix(ci): explicit exit 0 in the packed-assembly-version self-test and guard (publish-nuget 39152113710)

.github/scripts/check-packed-assembly-versions.ps1

@@ -107,3 +107,6 @@ if ($bad.Count -gt 0) {
     Write-Error "$($bad.Count) packed assembly version problem(s); expected every first-party DLL at $expected ($checked checked in $($packages.Count) packages). Nothing may be pushed."
 }
 Write-Host "All $checked first-party DLLs in $($packages.Count) packages are AssemblyVersion $expected."
+# EXPLICIT, the self-test's lesson (publish-nuget run 39152113710): GitHub's pwsh shell appends `exit $LASTEXITCODE`, so a
+# step's verdict must never rest on whatever native code ran last. A failure above is a terminating Write-Error ('Stop').
+exit 0

.github/scripts/check-packed-assembly-versions.selftest.ps1

@@ -95,3 +95,7 @@ finally { Remove-Item -Recurse -Force $work -ErrorAction SilentlyContinue }
 
 Write-Host "check-packed-assembly-versions self-test: $pass ok, $fail failed"
 if ($fail -gt 0) { exit 1 }
+# EXPLICIT (publish-nuget run 39152113710): the last case runs the guard on a NEGATIVE package, where it exits 1 on
+# purpose, so $LASTEXITCODE is 1 here — and GitHub's pwsh shell appends `exit $LASTEXITCODE` when it exists, turning a
+# passing self-test ("6 ok, 0 failed") into a failed step. The verdict is $fail, said here, never a leaked native code.
+exit 0

.github/workflows/publish-guards.yml

@@ -0,0 +1,37 @@
+# The publish GATES' own self-tests, on every pull request and every push to master — not only at publish time.
+#
+# publish-nuget run 39152113710 failed the "packed-assembly-version guard's self-test" step on its FIRST CI run, after
+# printing "6 ok, 0 failed": the self-test's last case left $LASTEXITCODE at 1, and GitHub's pwsh shell appends
+# `exit $LASTEXITCODE`. A gate that only runs at publish shows its own defects at the worst moment. This runs it the
+# SAME way (shell: pwsh, the same script), so the same wrapper judges it on every PR.
+name: publish guards
+
+on:
+  pull_request:
+    branches: [master]
+  push:
+    branches: [master]
+  workflow_dispatch:
+
+concurrency:
+  group: publish-guards-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  selftests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Setup .NET
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: |
+          9.0.x
+          10.0.x
+
+    - name: Guard - the packed-assembly-version guard's self-test
+      shell: pwsh
+      run: ./.github/scripts/check-packed-assembly-versions.selftest.ps1