:bug: ensure `release` job blocks PRs, fix broken markdown format

[twentylemon]

Summary

1001 for some reason auto-merged despite the test check failing. release is the only check that is required for branch protections, and it was skipped because test failed, which apparently counts as succeeding. Docs say use the always() conditional expression in addition to needsuse the always() conditional expression in addition to needs, but that isn't exactly useful either since we want release to just be a marker. Chaining always() with failure() should work? Draft for testing it out. contains works better, actions link to failure.

This also fixes the broken format.

Checklist

• [ ] this is a source code change
  • [x] run format in the repository root
  • [ ] run pytest in the repository root
  • [ ] link to issue being fixed using a fixes keyword, if such an issue exists
  • [ ] update the wiki documentation if necessary
• [ ] or, this is not a source code change

[codecov[bot]]

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 96.46%. Comparing base (cec7517) to head (910519a). Report is 1 commits behind head on main.

Additional details and impacted files

```diff @@ Coverage Diff @@ ## main #1002 +/- ## ======================================= Coverage 96.46% 96.46% ======================================= Files 94 94 Lines 2206 2206 Branches 160 160 ======================================= Hits 2128 2128 Misses 67 67 Partials 11 11 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.