[Epic] Release agent hardening and safe publish gates

[ashleyshaw]

Epic Summary

Package the post-v0.5.0 release safety work into one tracked programme so the release path becomes safer, more predictable, and easier to verify.

Linked Stories/Tasks

• Child 1: Make live releases fail fast on dirty state and mismatched metadata
• Child 2: Harden the release workflow with approval and concurrency gates
• Child 3: Replace placeholder release tests with behavioural coverage
• Child 4: Add release guardrails, runbook updates, and rollback verification

Milestones & Timeline

• Phase 1: release agent safety gates
• Phase 2: workflow hardening and approval gates
• Phase 3: behavioural tests and workflow coverage
• Phase 4: guardrails, runbook, and rollback verification

Acceptance Criteria

• All linked stories/tasks completed
• Documentation and changelog updated where needed
• Tests/QA complete
• Milestone closed

Dependencies / Blockers

• Release workflow and release agent changes must land before the release tag is cut from the release branch.
• The release path must remain develop -> release branch -> main.

Additional Context

• Source pack: .github/projects/active/release-agent-hardening/
• Strict proposal order is captured in the issue execution plan.

[linear-code]

LS-921

[ashleyshaw]

Branch governance hardening is now implemented on a codex branch and validated locally. The current PR adds a stronger branch guard, moves the check into the workflow context, and extends CI with issue-field and retired-doc validation. This is part of the broader safe publish gates workstream.

[ashleyshaw]

Branch governance hardening is now implemented on a codex branch and validated locally. The current PR adds a stronger main branch guard, moves the check into the workflow context, and extends CI with issue-field and retired-doc validation. This is part of the broader safe publish gates workstream.