ci: make the cleanup gate and the stuck-job watchdog mean what they report

.github/workflows/perf-numbers.yml

@@ -495,7 +495,19 @@ jobs:
         timeout-minutes: 2
         uses: Ambiguous-Interactive/ambiguous-organization-build-lock/.github/actions/require-confirmed-unity-cleanup@ce12fde93e67a27062350601fb97e4a2f546d405
         with:
-          acquired: ${{ steps.acquire_lock.outputs.acquired }}
+          # A leg that aborts before `Acquire organization Unity lock` runs never
+          # took a seat, and this gate's own contract treats `acquired: false` as
+          # proof that licensed cleanup was not required. Feeding it the skipped
+          # step's EMPTY output instead made it fail closed on work that never
+          # started, so a leg with one honest failure reported two (#327).
+          #
+          # This does not weaken the gate. It reads `outcome`, not `acquired`, and
+          # only the two values that prove the step never executed map to 'false'.
+          # An acquire that RAN and failed part-way reports outcome=failure while
+          # `acquired` reads empty, so the empty value still flows through and the
+          # gate still fails -- that ambiguous shape is the seat leak the bare
+          # `if: always()` above exists to catch, and it stays caught.
+          acquired: ${{ (steps.acquire_lock.outcome == 'skipped' || steps.acquire_lock.outcome == '') && 'false' || steps.acquire_lock.outputs.acquired }}
           classification-complete: ${{ steps.cleanup_classification.outputs.classification-complete }}
           cleanup-status: ${{ steps.cleanup_classification.outputs.resource-cleanup-status }}
           cleanup-health: ${{ steps.cleanup_classification.outputs.resource-health }}

.github/workflows/release.yml

@@ -459,7 +459,19 @@ jobs:
         timeout-minutes: 2
         uses: Ambiguous-Interactive/ambiguous-organization-build-lock/.github/actions/require-confirmed-unity-cleanup@ce12fde93e67a27062350601fb97e4a2f546d405
         with:
-          acquired: ${{ steps.acquire_lock.outputs.acquired }}
+          # A leg that aborts before `Acquire organization Unity lock` runs never
+          # took a seat, and this gate's own contract treats `acquired: false` as
+          # proof that licensed cleanup was not required. Feeding it the skipped
+          # step's EMPTY output instead made it fail closed on work that never
+          # started, so a leg with one honest failure reported two (#327).
+          #
+          # This does not weaken the gate. It reads `outcome`, not `acquired`, and
+          # only the two values that prove the step never executed map to 'false'.
+          # An acquire that RAN and failed part-way reports outcome=failure while
+          # `acquired` reads empty, so the empty value still flows through and the
+          # gate still fails -- that ambiguous shape is the seat leak the bare
+          # `if: always()` above exists to catch, and it stays caught.
+          acquired: ${{ (steps.acquire_lock.outcome == 'skipped' || steps.acquire_lock.outcome == '') && 'false' || steps.acquire_lock.outputs.acquired }}
           classification-complete: ${{ steps.cleanup_classification.outputs.classification-complete }}
           cleanup-status: ${{ steps.cleanup_classification.outputs.resource-cleanup-status }}
           cleanup-health: ${{ steps.cleanup_classification.outputs.resource-health }}
@@ -732,7 +744,19 @@ jobs:
         timeout-minutes: 2
         uses: Ambiguous-Interactive/ambiguous-organization-build-lock/.github/actions/require-confirmed-unity-cleanup@ce12fde93e67a27062350601fb97e4a2f546d405
         with:
-          acquired: ${{ steps.acquire_lock.outputs.acquired }}
+          # A leg that aborts before `Acquire organization Unity lock` runs never
+          # took a seat, and this gate's own contract treats `acquired: false` as
+          # proof that licensed cleanup was not required. Feeding it the skipped
+          # step's EMPTY output instead made it fail closed on work that never
+          # started, so a leg with one honest failure reported two (#327).
+          #
+          # This does not weaken the gate. It reads `outcome`, not `acquired`, and
+          # only the two values that prove the step never executed map to 'false'.
+          # An acquire that RAN and failed part-way reports outcome=failure while
+          # `acquired` reads empty, so the empty value still flows through and the
+          # gate still fails -- that ambiguous shape is the seat leak the bare
+          # `if: always()` above exists to catch, and it stays caught.
+          acquired: ${{ (steps.acquire_lock.outcome == 'skipped' || steps.acquire_lock.outcome == '') && 'false' || steps.acquire_lock.outputs.acquired }}
           classification-complete: ${{ steps.cleanup_classification.outputs.classification-complete }}
           cleanup-status: ${{ steps.cleanup_classification.outputs.resource-cleanup-status }}
           cleanup-health: ${{ steps.cleanup_classification.outputs.resource-health }}