CI: retry the v0.48.1 tag fetch before the publication input gate

.github/workflows/_unit-suite.yml

@@ -274,7 +274,13 @@ jobs:
       - name: Publication input gate
         run: |
           set -euo pipefail
-          git fetch --force origin refs/tags/v0.48.1:refs/tags/v0.48.1
+          # A runner that briefly cannot reach github.com must not fail the
+          # merge-queue group: retry the tag fetch before giving up.
+          for attempt in 1 2 3; do
+            git fetch --force origin refs/tags/v0.48.1:refs/tags/v0.48.1 && break
+            if [ "$attempt" = 3 ]; then exit 1; fi
+            sleep 20
+          done
           node scripts/release-gate-v049.mjs --check-inputs
 
       - name: Cargo build (debug — needed by plugin e2e tests)

.github/workflows/release.yml

@@ -777,7 +777,15 @@ jobs:
         working-directory: packages/aft-cli
 
       - name: Fetch final v0.48.1 activation baseline
-        run: git fetch --force origin refs/tags/v0.48.1:refs/tags/v0.48.1
+        run: |
+          set -euo pipefail
+          # Retry so a brief network failure reaching github.com does not
+          # fail the release.
+          for attempt in 1 2 3; do
+            git fetch --force origin refs/tags/v0.48.1:refs/tags/v0.48.1 && break
+            if [ "$attempt" = 3 ]; then exit 1; fi
+            sleep 20
+          done
 
       - name: Prepare publication records from the tagged candidate
         run: node scripts/release-gate-v049.mjs --prepare --snapshot-dir "${{ runner.temp }}/governed-publication" --candidate

.github/workflows/tests.yml

@@ -103,7 +103,14 @@ jobs:
         run: bun run --cwd packages/aft-bridge build
       - name: Governed-docs aggregate input validator
         run: |
-          git fetch --no-tags origin refs/tags/v0.48.1:refs/tags/v0.48.1
+          set -euo pipefail
+          # A runner that briefly cannot reach github.com must not fail the
+          # check: retry the tag fetch before giving up.
+          for attempt in 1 2 3; do
+            git fetch --no-tags origin refs/tags/v0.48.1:refs/tags/v0.48.1 && break
+            if [ "$attempt" = 3 ]; then exit 1; fi
+            sleep 20
+          done
           node scripts/release-gate-v049.mjs --check-inputs
 
   pr-checks:

benchmarks/aft-search/slice-descriptors/land-tag-fetch-retry.json

@@ -0,0 +1,12 @@
+{
+  "slice_class": "non_ranking",
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "fixtures": [
+    "harness-goldens"
+  ],
+  "slices": [
+    "tag-fetch-retry"
+  ],
+  "note": "CI only: the v0.48.1 tag fetch before the publication input gate retries three times, so a runner that briefly cannot reach github.com does not fail a merge-queue group. No engine or ranking files change."
+}