ci(release): PR-merge-only releases + client-id auth

[jimCresswell]

What & why

Owner direction (point 7): release creation originates only from a merge to main.

• Remove the manual workflow_dispatch trigger and the forced-increment / manual-major path. A breaking marker still stands the auto-release down, and the prevent-accidental-major commit-msg hook still blocks markers; the rare major is cut by a human engineer outside this repo's automation.
• audit_release_workflow now forbids workflow_dispatch (it previously required it) — releases are structurally PR-merge-only. Tests updated.
• Auth via client-id (RELEASE_APP_CLIENT_ID) instead of the deprecated app-id.

Governance doc reconciled to verified state

Checked against the live API: required status checks (Quality gates, Secret scanning, CodeQL, SonarCloud) and a v* tag ruleset are now enforced; the only outstanding owner action is the GitHub Code Quality org preview. The release-bot secrets + bypass actor are in place.

Also

• Scrubbed the predicted version number from continuity (per "don't assume future release values") and recorded that continuous release is verified and PR-merge-only.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-code-quality]

Code Coverage Overview

Languages: Python

Python / code-coverage/pytest

The overall coverage remains at 89%, unchanged from the main branch.

---

_{Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[Copilot]

Pull request overview

This PR updates the repository’s release governance to ensure releases can only be created automatically after a successful CI run on main (i.e., originating from merges to main), removes the manual workflow_dispatch release path, and switches GitHub App authentication from app-id to client-id (RELEASE_APP_CLIENT_ID) across code and documentation.

Changes:

• Enforce “no workflow_dispatch” in audit_release_workflow, and update the corresponding unit tests.
• Remove workflow_dispatch (and forced increment logic) from the Release workflow so release creation is strictly CI-on-main driven.
• Reconcile repository documentation and operational continuity notes to reflect the verified PR-merge-only continuous release model and the client-id secret naming.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tools/repo_audit.py	Updates the audit rule to forbid workflow_dispatch for the release workflow.
tests/test_repo_audit.py	Updates test fixtures and assertions to match the new “dispatch forbidden” audit behavior.
README.md	Updates release documentation to reflect PR-merge-only releases and RELEASE_APP_CLIENT_ID.
docs/repository-governance.md	Updates governance checklist to match current enforced GitHub settings and release bot wiring.
docs/dev-tooling.md	Updates release tooling documentation to remove manual dispatch and reference client-id auth.
.github/workflows/release.yml	Removes manual dispatch trigger and forced increment path; switches token creation to client-id.
.agent/memory/operational/repo-continuity.md	Updates continuity notes to remove predicted versions and record PR-merge-only release verification.