Release scripts still carry 0.68.2's V/T/MS/EPIC and AP=/mnt/... — and the hardcoded-path ratchet does not match /mnt, so nothing catches it #3618

The ported release scripts still carry 0.68.2's constants, and one of them is invisible to every gate we own.

Split out of #3459 so its stated criterion can govern that issue. #3459's criterion is "tag step calls scripts/check_milestone_cut.sh and cannot be reached without it" — satisfied by #3617. This is the carry-forward, and it was never part of that criterion.

What is still hardcoded in scripts/release/

• V, T, MS, EPIC — all still 0.68.2's values
• AP=/mnt/nvme-raid0/agent-wt/rel-0682-autopilot

Why AP is the dangerous one

scripts/check_hardcoded_paths.sh does not match /mnt — proved in #3592 with a committed two-path probe that scored +1, not +2. So AP passes the hardcoded-path ratchet, passes --full-if-capable, and passes every other gate in the tree.

The only thing standing between it and the next release is a paragraph in #3617's body, written explicitly as "this paragraph is the only guard that exists for it." A prose warning in a merged PR body is not a guard — it is a thing nobody will read at T-0 five days from now, and the failure mode is a 0.69 train pointed at a 0.68.2 worktree that may not exist.

done_when

1. V/T/MS/EPIC are derived or passed, never literals.
2. AP is derived from the repository, not from a path under /mnt. The scripts are in-tree now; an out-of-tree bundle path is a leftover of where they used to live.
3. Either the /mnt blind spot closes (The hardcoded-path analyser ignores /mnt entirely — a committed file with both /home and /mnt paths scores +1, not +2, so operator-box paths enter the tree unopposed #3592) or this row ships its own assertion that no release script references a path outside the repo. Prefer the first — the blind spot affects every script, not these.
4. Falsifier: reintroduce a literal /mnt/... in a release script and require a gate to go RED. If nothing can be made to go red, item 3 is unsatisfied regardless of what was edited.

Why it is split rather than bundled

Mixing parameterisation into #3617 would have made the milestone gate unreviewable — which is that ticket's own lesson about scope. The split is the author's call and it was right; what was wrong was keeping #3459 open for it, since an issue held open for work outside its criterion is the same substitution as closing one for work inside it. Both replace the contract with a judgement.

Refs #3459, #3617, #3592.