rfc: delivery/RULES.md#5 — bless a continuous :latest channel published on push to main

[elronbandel]

Which rule

• Document: .agents/delivery/RULES.md
• Rule number / section: rule 5 ("Tag-gated publishing")
• Current text (pasted verbatim):

5. Tag-gated publishing. The crate and the tagged image fleet MUST be published only by a vX.Y.Z tag push or an explicit workflow_dispatch, never by a branch push.

Proposed new text

5. Tag-gated publishing. The crate and any versioned image fleet MUST be published only by a vX.Y.Z tag push or an explicit workflow_dispatch, never by a branch push.
6. Continuous channel. A push to the default branch MAY publish the latest fleet channel, and MUST publish only images whose build inputs changed.

Rationale

Rule 5 was written when every fleet publish was a full ~438-image rebuild — branch-push publishing had to be forbidden because it was unaffordable and indiscriminate. The carried-forward chain (rules 12–14, merged #293–#307 and live-proven: a repeat dispatch built nothing) changes the economics: "what changed" is now mechanical (fleet-status), and unchanged images carry forward. A continuous latest channel published per push is exactly the two-channel model principle 9 already sketches ("latest on main") — it just becomes continuously true instead of true-at-release-moments.

The rescope keeps rule 5's real content intact: versioned releases (the immutable, CVE-gated, checklist-walked artifacts consumers pin) remain deliberate, tag/dispatch-only. Rule 16 constrains the new channel to publish only the delta — a full-fleet branch publish stays out of bounds.

Impact analysis

• Consumers of :latest get main's state within one workflow run of merge instead of at the next manual dispatch/release. Consumers of vX.Y.Z see no change.
• CI cost: bounded by the delta — a push touching one benchmark builds one leaf + its combos; a docs/cli push (path-filtered) fires nothing. One-time convergence cost on the first run: currently-unlabeled images (~124) rebuild once to acquire labels.
• Enforcement: the implementing workflow change is the code-side PR; rule 16's "only what changed" is mechanically satisfied by the enumerate-time freshness pruning + per-job carry-forward checks.

Migration path

1. This PR: rules only.
2. Code PR: push: branches [main], paths ['containers/**', workflow] trigger on release-images.yml; enumerate prunes the leaf/combo matrices to the stale set on push events (safe at :latest — unchanged images are already at the target tag; tagged releases keep the full matrix); per-task stays tag/dispatch-only.