Context

The pre-publish job's shallow checkout (fetch-depth: 1) breaks Pre Publish's merge into master after the tag is pushed (2.9.1, 2.9.2). Dry runs skip that merge, so they can't catch it.

Definition of Done

• Set fetch-depth: 0 on secure-checkout in pre-publish.
• Before Pre Publish, fail if origin/master is missing, the checkout is shallow, or the release branch has commits not on master.