ci: tag-driven release (PyPI + GitHub Release + v0 in one workflow)

[lesnik512]

Adapts modern-di's tag-driven release (#233/#235) to semvertag. A hand-pushed
bare semver tag becomes the sole release entry point: one release.yml
publishes to PyPI (version from the tag), creates the GitHub Release (body from
planning/releases/<tag>.md when present), then floats the v0 action tag —
PyPI first, so a failed publish creates no Release.

Why it's not a straight copy

semvertag dogfoods its own auto-tagger, which modern-di does not. So:

• semvertag.yml switches to dry-run (contents: read, no push token) — it
  still exercises action.yml on every push to main but never pushes a tag,
  so the only tags reaching the repo are deliberate, maintainer-pushed releases.
• tag-major.yml (was on: release: published) is folded into release.yml
  as a final Float major tag step. A Release created by release.yml with
  GITHUB_TOKEN would not have re-fired the old release: published trigger
  (GitHub's anti-recursion rule), so a standalone tag-major.yml would have
  silently stopped updating v0.
• publish.yml (on: release: published) is deleted — no double-publish
  window.

Docs

The contributor-facing release runbook (docs/contributing/release.md, also
stale — it described OIDC/tag-guard machinery that no longer exists) is removed
from the docs site; a maintainer-only runbook lives in CLAUDE.md.

Verification

• release.yml / semvertag.yml parse as YAML; no live references to the
  deleted workflows survive.
• just lint-ci, just docs-build (strict), and just test (457 passed, 100%
  coverage) all green.
• The true integration test is the next real release (push a tag, watch
  release.yml).

Reviewer notes (non-blocking, from the whole-branch review)

• Empty body_path fallback relies on action-gh-release treating it as unset
  (correct today; faithful to the modern-di template).
• Post-PyPI partial-failure recovery is now documented in the CLAUDE.md
  runbook.
• Third-party actions use floating-major pins per repo convention (not
  SHA-pinned).

Spec + plan: planning/changes/2026-06-25.01-tag-driven-release/.

🤖 Generated with Claude Code