ci: block publishing BREAKING.md with unfilled <TODO placeholders

The v8 BREAKING.md entries are seeded placeholders that each removal PR
fills in. Add a guard to the stable publish pipeline that fails if any
<TODO marker remains, so the "each removal PR fills it in" contract is
enforced rather than risking placeholders shipping to users at 8.0.0.

Author: gnbm

.github/workflows/cd.yml

@@ -19,6 +19,14 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
+      - name: Guard against unfilled BREAKING.md placeholders
+        # The removal PRs fill in each command's entry. Block a stable publish
+        # if any <TODO placeholder would otherwise ship to users.
+        run: |
+          if grep -n '<TODO' BREAKING.md; then
+            echo "::error file=BREAKING.md::BREAKING.md still contains <TODO placeholders; each removal PR must fill in its entry before publishing."
+            exit 1
+          fi
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 18