Retire the both-branch matrix for symmetric single-branch self-release

[ptr727]

PR B of the release-model simplification (PR A #248 landed the Docker platform split). Rewrites the publisher + the WORKFLOW.md contract.

Hub publisher (publish-release.yml) -> dispatch-only single-branch. Drops the branch matrix, the plan job, the weekly schedule (a Docker base-image refresh concept that does nothing for a source archive), the push auto-publish, PUBLISH_ON_MERGE, and IGNORE_GITHUB_REF (each run builds one branch, so github.ref names it and NBGV classifies it directly). A source-only release is a deliberate dispatch of main (release) or develop (prerelease).

WORKFLOW.md contract updated to the single-branch model: each publish builds one branch; Docker/package repos self-release the pushed branch on a release-affecting push (shared paths filter) + a main-only weekly schedule + dispatch; source-only repos dispatch only. D3.1/D4.1/D2.3, the release-model prose + diagram, and the 5B scenarios (S5-S8) rewritten; the IGNORE_GITHUB_REF requirement and the both-branch matrix retired.

Held for your merge - it rewrites the hub live release pipeline and the fleet release contract. The Docker/package repo rollout (symmetric push + paths filter) follows per-repo.

[Copilot]

Pull request overview

Simplifies the release model by retiring the both-branch publish matrix in favor of a single-branch publish run, updating both the hub publisher workflow and the WORKFLOW.md contract to match a dispatch-driven source-only release model.

Changes:

• Updated WORKFLOW.md release-model contract and scenarios to describe single-branch publishing (main = release, develop = prerelease) and remove matrix-specific requirements.
• Simplified .github/workflows/publish-release.yml to be dispatch-only, publishing exactly the dispatched branch and removing the plan/matrix plumbing.
• Added an explicit dispatch-branch guard to prevent publishing from unintended refs.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
WORKFLOW.md	Updates the release contract and scenarios to the single-branch publisher model.
.github/workflows/publish-release.yml	Reworks the hub publisher into a dispatch-only, single-branch release workflow.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

.github/workflows/publish-release.yml:67

• The Create GitHub release step is currently unconditional because this workflow only runs on workflow_dispatch, so github.event_name == 'workflow_dispatch' makes the if: expression always true. That means release-exists is computed but never used to enforce the documented no-op republish behavior, and repeated dispatches will re-run the release-update path (potentially regenerating release notes) even when the tag already exists.

      # Skip create on an existing tag (no-op republish); a re-dispatch refreshes it.
      - name: Check for existing release step
        id: release-exists
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ steps.nbgv.outputs.SemVer2 }}
        run: |
          set -euo pipefail
          if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
          fi

      # target_commitish pins the tag to the exact built commit (GitCommitId), not the default branch. The release is
      # the tag plus GitHub's auto source archive, README, and LICENSE - no build assets (source-only).
      - name: Create GitHub release step
        if: ${{ steps.release-exists.outputs.exists == 'false' || github.event_name == 'workflow_dispatch' }}
        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1