Upgrade reusable release workflow orchestration

[jmcte]

Summary

• Add reusable release workflow metadata derivation, exact SemVer validation, and branch ancestry guards for main or matching release/X.Y refs.
• Add optional version/build hooks, release notes file support, and safer ordering before floating tag promotion.
• Address review feedback by rejecting zero-padded SemVer components before publish or floating tag updates.
• Normalize manifest CI customization fields used by rendered workflow paths and custom scripts so the repo check gate typechecks.

Governing Issue

Closes #22

Validation

• npm test -- tests/reusable-workflows.test.ts passed.
• npm run check passed.
• Required PR checks are expected to satisfy CI Gate after this branch update and PR body refresh.

Bootstrap Governance

• Changes are scoped to the linked issue and the active review feedback.
• Contributor or PR guidance changes are not required for this release workflow change.
• Auto-merge is currently blocked until PR Fast CI reruns on the pushed branch and review-thread state is cleared.
• No real secrets, runtime auth, or machine-local env files are committed.

Merge Automation

• Auto-merge is currently blocked by required checks/review-thread state; re-enable after the refreshed checks pass and the review thread is resolved.

Notes

• The previous PR body used the older ## Verification / ## Risk shape, which caused Validate PR Description and then CI Gate to fail.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9ee00d661a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[athena-omt]

Approved. I reviewed the reusable release workflow changes and the test updates. The new metadata derivation, exact SemVer validation, default/maintenance branch ancestry guard, optional version/build hooks, release-notes support, and ordering before floating tag promotion all look consistent with the PR intent.

Local verification on the assigned worker worktree passed:

• npm test -- tests/reusable-workflows.test.ts --reporter=verbose
• npm run check — 8 test files / 50 tests passed

The PR is still blocked by the current PR Fast CI/description gate state, but I did not find a source-level blocker in this review.

[athena-omt]

Approved. I reviewed the current head 59202965f03a554058a457ee7a555a20deec793c in the required Athena worktree. The release metadata derivation, exact SemVer validation including zero-padded component rejection, branch ancestry guard, optional version/build hooks, release-notes handling, and floating tag promotion ordering look consistent with the issue scope and reusable workflow contract.

Local validation passed:

• npm test -- tests/reusable-workflows.test.ts --reporter=verbose
• npm run check — 8 test files / 50 tests passed

Live PR checks also show the refreshed CI Gate/PR Fast checks passing; the remaining BLOCKED state appears review/branch-protection related rather than a source-level blocker.

[pheidon]

Approved. I reviewed the release workflow orchestration changes at head 5920296, including the stricter SemVer metadata derivation, default/maintenance branch ancestry guard, optional version/build hooks, release-notes handling, release-before-floating-tag ordering, and manifest-driven custom CI/path additions.\n\nLocal validation passed in an isolated worktree:\n- npm test -- tests/reusable-workflows.test.ts --reporter=verbose\n- npm run check — 8 test files / 50 tests passed\n\nLive PR checks show the refreshed required checks passing; I did not find a source-level blocker.