ci+release: split tray and platform into independent release tracks

[ntatschner]

Summary

Decouples the Tauri tray installer cadence from the server + web container image cadence. Each track now has its own version number, its own tag schema, and its own auto-alpha trigger.

Track	Tag schema	Version surface	Fires
tray	tray-vX.Y.Z[-channel.N]	crates/starstats-client/Cargo.toml + tauri.conf.json	release.yml
platform	vX.Y.Z[-channel.N] (unchanged)	[workspace.package].version (drives core + server)	release-images.yml

Web-only changes no longer churn the tray's signed MSI / channel manifest. Tray bug fixes no longer force a server redeploy.

Design rationale: docs/superpowers/specs/2026-05-23-release-tracks-split.md (in this PR).

What changed

• scripts/release-promote.mjs — every prerelease/live subcommand now takes a <tray|platform> track argument. New pure helpers tagPrefix, parseTrackTag, bumpClientCargo. latestSemverFromTags accepts an optional track filter. 49 new unit tests cover the track plumbing (67 total, all green).
• crates/starstats-client/Cargo.toml — switched from version.workspace = true to literal version = "1.8.4". The starstats-client → starstats-core dep is a path dep, so version skew is irrelevant. starstats-core + starstats-server still inherit from workspace.
• .github/workflows/release.yml — trigger tray-v*. validate-tag strips the prefix before applying existing channel rules + emits a bare_version output. Manifest path is release-manifests/tray-<channel>.json. New step generates a per-component changelog (git log filtered to tray paths since the previous tray-v* tag) and injects into the GH Release body via body_path, replacing GH's auto-generated notes (which would otherwise pick the literal previous tag — possibly a platform vX.Y.Z — and leak platform-only commits into the tray release body).
• .github/workflows/promote.yml — new detect-tracks setup job. workflow_dispatch takes a track input (tray/platform/both). Push-to-next auto-alpha uses dorny/paths-filter@v3 to bump only the tracks whose files changed; docs-only pushes tag nothing. starstats-core triggers both tracks (necessary shared-dep over-eagerness). Self-bump commits are skipped to break the loop.
• .github/workflows/ci.yml — should-run skip list adds chore: bump tray to and chore: bump platform to for the new bot-commit message format.
• release-manifests/{alpha,beta,rc,live}.json renamed to release-manifests/tray-{alpha,beta,rc,live}.json (git mv, history preserved).
• crates/starstats-client/src/config.rs + tauri.conf.json — manifest_url() + the static updater endpoint updated to the new path.
• apps/web — platform version surfaced as a sub-footer chip on both signed-in and marketing layouts. Build-time inlined via next.config.mjs's env: block, sourced from workspace Cargo.toml.
• CLAUDE.md + docs/RELEASING.md — branch model + quick-reference table updated.
• docs/superpowers/specs/2026-05-23-release-tracks-split.md — full design spec.

Glob non-overlap

GitHub's v* tag glob anchors at start of string. tray-v1.8.4 starts with t, not v — so release-images.yml's existing tags: ['v*'] trigger never fires on tray tags. No tags-ignore workaround needed.

Migration

One-time, per the user's "internal/dogfood, re-pair acceptable" call:

• Old in-the-wild tray installers polling release-manifests/<channel>.json get a 404 on their next update check. Users re-download + re-pair from the latest GH release.
• First post-merge auto-alpha will tag both tray-v1.8.5-alpha.1 AND v1.8.5-alpha.1 (the PR itself touches both track paths), establishing the baseline.

Out of scope (future PRs)

• Platform GH releases with their own changelog (currently release-images.yml only publishes container images, no GH Release).
• release-notes/<track>/<version>.md narrative summaries appended into release bodies.
• Roadmap-emit track-aware slugs.

These were flagged but cut from this PR to keep it focused on the version split mechanism.

Dependency note

This PR conflicts with PR #89 on ci.yml (both edit the should-run job). Whichever lands first is fine — the other rebases trivially on top.

Test plan

• node --test scripts/release-promote.test.mjs — 67 tests pass locally
• All 4 workflow YAML files parse cleanly
• CI run on this PR is green
• After merge to next: verify auto-alpha fires both tracks (this PR touches both tray and platform paths)
• Follow-up tray-only commit on next produces only tray-vX.Y.Z-alpha.N (no platform tag)
• Follow-up web-only commit produces only vX.Y.Z-alpha.N (no tray tag)
• First live cutover produces tray-v1.8.5 + v1.8.5 simultaneously
• Web sub-footer chip renders "platform v1.8.5" on a deployed build
• GH Release body for first tray-v* after merge shows the per-component changelog (commits touching only tray paths)