release-rulez

SUSPICIOUS: the workflow purpose is coherent for release automation, and the visible commands mostly match that purpose. Main concerns are autonomous repo-modifying actions (auto-merge/tag/push) and unreviewed local scripts whose behavior is not included; this is elevated operational risk more than clear malware.