rota-release

SUSPICIOUS. The release-management behavior largely matches the stated purpose and includes strong manual gates for risky actions, so this is not malware. However, it can publish releases, push branches/tags, and close issues remotely, and those actions depend on a `rota` CLI whose provenance is not verified in the provided evidence; combined with limited auto-dispatch to another skill, that makes the skill medium risk overall.