Release

Preflight

1. Read docs/development/quality-gates.md, the release row in docs/development/task-context-map.md, and docs/development/release-security.md.
2. Confirm main is clean, current with origin/main, reviewed, and green. Check that the planned version tag is absent remotely and that no unresolved draft release or concurrent release is in progress.
3. Require repository release immutability to be enabled. The release workflow cannot check this: the endpoint needs the Administration read permission, which is not a grantable workflow token scope. Verify it here, with maintainer credentials, as the only gate: