fix!: repoint published schema namespace to a controlled URI root

[Brad-Edwards]

Summary

Three related fixes on the identity-cutover surface, found by pulling one thread.

1. The published schema namespace pointed at a domain we do not own.

The canonical root was https://raes.dev/schemas/, adopted during the identity cutover in #921. raes.dev is registered to a third party — as was aces.dev before it, which belongs to the Auto Care Association (ACES = Aftermarket Catalog Exchange Standard) and redirects to their site.

Using a domain the project does not control forfeits the one property the URI form of $id exists to provide: that the identifier is unambiguously ours to assign. It also left #908 blocked on OBL-908-REMOTE-IDENTITIES-1, an obligation to "provision raes.dev" that cannot be discharged.

Per the JSON Schema specification, $id is an identifier and imposes no behaviour — "JSON Schema does not guarantee that a schema with an HTTP URL identifier is actually resolvable at such URL." Official guidance is to use a domain you control when serving schemas over HTTP, and a non-locatable URI otherwise. Nothing in this repo dereferences $id.

The root is now https://raesystem.github.io/rae/, bound to this repository's own GitHub organisation: uniquely controlled, no DNS obligation, and matching the Pages path if the schemas are ever served. The alternative considered was urn:uuid: per schema — unimpeachable but opaque across 84 contracts.

2. The identity gate was guaranteed to go stale on every release.

check_identity_cutover pinned CHANGELOG.md by whole-file digest, but release-please rewrites that file on every release, inserting each new section above the existing ones. The pin goes stale by construction.

It did at v2.0.0. PR #937 back-merged the release into dev with the required verify check failing, and it was merged anyway — dev has been red on this gate since 2026-07-27.

generated-release-history replaces the whole-file pin with one that matches how the file is actually maintained: the classified tail is pinned exactly, and everything written above it is held to the live-tree rule of zero retired identity occurrences. This is stricter than what it replaces — the old rule permitted any content anywhere so long as the digest was re-recorded, which is precisely the re-record-and-move-on habit that let the override stand. Editing or truncating the tail still fails closed.

3. Nothing checked the text that lands in the changelog.

Fixing (2) leaves the failure in the right place but still late: a retired name in a commit subject would pass every check on its own PR and surface days later as a red release PR. The guard that already runs on PRs into dev now rejects retired naming in the title and in BREAKING CHANGE: footers.

The text it checks is the text that actually reaches the changelog. This repo squashes with squash_merge_commit_title=PR_TITLE and squash_merge_commit_message=COMMIT_MESSAGES, so that is the PR title plus the commit messages — not the PR body. The workflow supplies the commit messages via a read-only API call written to a file, never shell-interpolated. Body prose is deliberately not checked: explaining the retired name is legitimate — this description does it — and prose outside a footer never reaches the changelog.

Changes

• 84 published $id values, the semantic-invariant profile URI, and the concept authority reference repointed (133 occurrences across 91 files).
• _RAES_SEMANTIC_INVARIANT_PROFILE_URI and the Literal annotations in raes_contracts updated to match.
• Schema-publication content hashes refreshed for all 84 affected entries, with a change-ledger summary on each.
• New generated-release-history record class in check_identity_cutover; manifest schema moves to historical-identity-records/v3.
• New pr-title-retired-identity rule in check_pr_title, with the pattern held equivalent to the gate's by test rather than imported (the guard is stdlib-only by design).
• Both identity corrections recorded as ADR-096 amendments with adr-index.yaml entries; the index identity digest is re-pinned.

Historical records under docs/decisions/ are otherwise untouched, per the ADR-096 boundary.

Verification

• All tools/check_*.py gates pass, including check_identity_cutover — which fails on dev today.
• Identity gate adversarially tested: retired identity in the generated head, edited tail, truncated tail, and wrong tail occurrence count each fail closed; a simulated future release passes.
• PR guard tested for both directions, including that surfaces, interfaces, and namespaces do not trip the word-boundary-anchored rule.
• Full Python suite: 5132 passed, 1 skipped.

Follow-up, not fixed here

• OBL-908-REMOTE-IDENTITIES-1 on ACES naming audit: 2020 live occurrences remain after the rename (full inventory) #908 is premised on provisioning raes.dev. There is no domain to provision; it should be closed as invalid. The SonarCloud and Ground Control project-identifier halves are unaffected by this PR.
• dev has enforce_admins: false, which is what allowed a failing required check to be merged. With a single maintainer, enabling it would block all merges, so this PR does not touch it.

Refs #908