Cutting an mkit release

A single signed vX.Y.Z tag is the whole release trigger. Pushing it drives three decoupled GitHub Actions workflows off the tagged tree. You never publish by hand; you prepare main, push a good tag, then verify each channel actually ran and its output is trustworthy.

docs/RELEASE.md in the repo is the authoritative runbook — this skill is the repeatable procedure over it. When a detail here disagrees with docs/RELEASE.md or the workflow files, the repo wins; re-read and update.

The three channels one tag drives

Every channel triggers on push: tags: 'v*.*.*' and checks out the tag's tree: