docs(release): correct the manual docs-publish fallback

[bioedca]

Follow-ups to #204 (which is merged). Found by an adversarial review pass over that diff — three real defects it left behind, all in docs/release.md. Docs-only.

1. The manual fallback omitted --ref — the bug it exists to recover from

#204 added --ref "$TAG" to the automatic dispatch, precisely because gh workflow run without it targets the remote's default branch. The hand-run command documented two paragraphs below it still said:

gh workflow run docs.yml -f version=1.0

So a maintainer recovering from a failed dispatch would publish whatever main holds at that moment under a released version's label — exactly the failure the fallback is there to repair, now with a human pressing the button. Corrected to gh workflow run docs.yml --ref v1.0.0 -f version=1.0, with the Actions-UI equivalent spelled out ("Use workflow from" must be the tag, not main).

2. Unquoted ? breaks the verification command on macOS

gh api repos/bioedca/tether/contents/versions.json?ref=gh-pages --jq …

? is a glob character in zsh, the default shell on macOS. Unquoted, this fails with no matches found before gh is ever invoked. Quoted, with a note saying why so it does not get "tidied" back.

3. Publishing always promotes — now stated

docs.yml unconditionally runs mike deploy --update-aliases <label> latest then mike set-default --push latest. There is no way to publish a version without taking over the latest alias and the site default. That is fine for the normal release path, but it is a trap for anyone dispatching an older ref to "just refresh" an old tree, and the runbook did not say so.

Pre-existing behaviour, not introduced by #204 — documenting rather than changing it, since altering the promotion semantics right before an rc is not a docs-PR-sized decision.

Verification

mkdocs build --strict exits 0.

Note on how these were found

My own multi-lens review of #204 raised all three, then my adversarial verification stage refuted them and reported the diff clean. Reading the raw findings by hand afterwards showed the verifiers were wrong, not the finders — the refute-by-default bias was set too aggressively. Codex, reviewing the same diff, independently caught two different real defects in #204 which are already fixed there. Recording this because "the automated pass said clean" was not a safe signal here.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 54c8ca90-b42a-4ceb-b9b1-7f987068671c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}