Create release

Prepare a release whose tag contains its changelog, then publish through exactly one evidence-backed path when publication is authorized.

Authorization

Prepare: determine the version, update changelog/version declarations, validate, and open the release PR. Requests to prepare, bump, or generate notes authorize only this stage.
Publish: after the PR merges, create or trigger the tag/release through the repository's established publisher. Requests to cut, tag, publish, or run /create-release authorize this stage too.
A /milestone-rush caller supplies publication authority at its verified milestone boundary. Reuse its settled release plan and version; no separate user command is required. /deliver integration delivery is not this trigger.
When standalone authorization is ambiguous, perform Prepare only.