fix: replace release.yml with a local script

[FaustClaw]

release.yml cannot work. Removing it rather than leaving a workflow that provably fails.

What happened

The v* tag ruleset restricts creation and update. release.yml pushes as github-actions[bot], which is not covered by the @labelzoom/labelzoom team bypass, so the run failed:

remote: error: GH013: Repository rule violations found for refs/tags/v1.0.0.
remote: - Cannot create ref due to creations being restricted.

Adding GitHub Actions to the bypass list is not possible. The picker doesn't offer it, and the API rejects it outright:

422: Actor GitHub Actions integration must be part of the ruleset source or owner organization

Actions is built into the platform rather than installed as an org integration, so it can never satisfy that condition.

Why a script rather than the alternatives

Relax the ruleset — would let any account with plain write access create or move v1, which is the ref 16 repos execute. That is the single thing this ruleset exists to prevent, and it is not hypothetical: the @FaustClaw agent account has write on every repo in the org and is deliberately not on the team.

Custom org-owned GitHub App — would work, since a custom app is installed in the org and does appear in the bypass picker. It also means a standing private key in repo secrets, in order to automate two git commands, on a repo that releases rarely. Poor trade, especially while we're removing long-lived credentials elsewhere.

So the promotion stays a deliberate local act by a human, which is the semantic the release environment was reaching for anyway — and with a single human in the org, a required-reviewer gate was never going to be real review.

What script/cut-release.sh keeps and adds

Keeps the workflow's guards: semver format validation, and refusing to overwrite an existing version tag. Adds three a workflow didn't need — clean working tree, on main, and level with origin/main — plus a confirmation prompt that states the blast radius.

Also in this PR

README.md documented a release path and a release environment that no longer exist. The @v1 safety argument is rewritten around the two controls that are actually in place: main requires a PR with code-owner review and a passing ci check under an empty-bypass org ruleset, and the v* tag ruleset limits tag creation to the team.

Verification

• shellcheck clean on cut-release.sh; guard paths exercised (no arg, 1.2.3, v1.2 all rejected).
• actionlint and zizmor clean on the remaining workflows.
• No stale references to release.yml or the release environment left in the tree.

Do not create the release environment — it has no consumer now.

🤖 Generated with Claude Code