feat(release): add release management workflows

[jackchuma]

What changed? Why?

Releases in this repo are cut by hand: someone creates a releases/vX.Y.Z branch, pushes RC tags (vX.Y.Z.rcN), and drafts the GitHub release. This adds the same release automation base/base uses, adapted to a repo with no version file and no build artifacts.

• Start Release (manual, bump type minor/patch/major): computes the next version from the latest final vX.Y.Z tag, creates releases/vX.Y.Z from main (or from the latest releases/vX.Y.* branch for patches), and pushes the branch together with its first RC tag in one atomic push, so a concurrent Create RC run cannot allocate the same RC number.
• Create RC (on push to releases/v*): tags each pushed commit with the next vX.Y.Z-rc.N. Serialized per branch with queue: max, as in base/base. Reruns reuse a tag already at that commit.
• Publish Release (manual, version X.Y.Z): creates or reuses the final vX.Y.Z tag at the release branch head, refuses to move an existing tag, and creates a draft GitHub release with generated notes.
• Release Branch CI: fails PRs into a release branch that already has its final tag. It also runs when a PR is edited, so retargeting a PR to a finalized branch reruns the check. It runs the check script from main, so a PR that backports the automation to an older release branch does not fail on a missing script. The check only runs on PR events; after publishing, maintainers rerun checks on open PRs or lock the branch (documented).
• Release Tests: runs scripts/release/test-release.sh (offline, throwaway git repo) and shellcheck when release scripts or workflows change. Also just test-release.
• docs/RELEASE.md describes the process; README links it.

Differences from base/base:

• No version-sync PR or 0.0.0 gate. The version comes from the release branch name.
• Start Release creates the first RC itself. Pushes made with GITHUB_TOKEN do not trigger other workflows, and there is no version-sync merge to trigger it.
• No Docker images, binaries, signing, or Build RC/Build Release workflows.

Notes to reviewers

• RC tags switch to base/base's vX.Y.Z-rc.N format. Numbering counts legacy vX.Y.Z.rcN tags, so after v8.4.0.rc2 the next RC is v8.4.0-rc.3. Only new-format tags are reused on retry.
• Push-triggered workflows only run on branches that contain them. Existing branches such as releases/v8.4.0 keep the manual process unless these files are backported.
• Start Release copies scripts/release from main before checking out the patch base, because older release branches do not contain the scripts.
• actionlint 1.7.12 rejects concurrency.queue as an unknown key. GitHub supports it and base/base uses it. actionlint does not run in this repo's CI.

How has it been tested?

• just test-release: passes. Covers RC numbering across both tag formats, exact-version filtering, numeric ordering (rc.10 after rc.9), retry reuse, version bumps and ordering (v8.10.0 > v8.9.0), the no-final-tag error, final-tag reuse, and refusing to move a final tag.
• shellcheck scripts/release/*.sh: clean.
• actionlint .github/workflows/*.yml: only the queue key finding above.
• The workflows have not run on GitHub yet; the first Start Release run is the end-to-end check.

Generated with Toshi

[cb-heimdall]

✅ Heimdall Review Status

Requirement	Status	More Info
Reviews	✅ 1/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

⚠️ Ignored Reviews (1)

Reviewer	Reason
leopoldjoy	Soft review, as user does not have write permissions

[jackchuma]

Review round 1

Reviewers: anthropic/claude-opus-5-5, cbhq-openai/gpt-6.1-sol (parallel)

• Fixed: [P2] Load trusted release tools when backporting the automation — .github/workflows/release-branch-ci.yml (0e03c58) — raised by both
• Fixed: [P3] Include the base branch in the Release Branch CI concurrency group — .github/workflows/release-branch-ci.yml (0e03c58)
• Fixed: [P2] Serialize initial RC creation with later RC jobs; branch and first RC now pushed atomically — scripts/release/start-release.sh (0e03c58)
• Fixed: [P2] Do not overclaim the merge freeze in docs — docs/RELEASE.md (0e03c58)
  Synced with main: 89302e9 (already current)
  Validation: just test-release passes; shellcheck scripts/release/*.sh clean; actionlint reports only the known concurrency.queue key

🤖 Reply generated with Toshi

[0xth4nh]

Looks Good to Thanh's Toshi

[leopoldjoy]

[P2] Please add types: [opened, synchronize, reopened, edited]: retargeting a PR from an unfinalised release branch to a finalised one otherwise leaves the previous passing check on the unchanged head SHA without rerunning this guard.

[jackchuma]

Fixed in fbaa6a5. Release Branch CI now runs on types: [opened, synchronize, reopened, edited], so retargeting a PR to a finalized release branch reruns the Finalized Release check. docs/RELEASE.md lists the events.

🤖 Reply generated with Toshi

[0xth4nh]

Looks Good to Thanh's Toshi