tech-debt T6: Delivery and the cross-repo contract: staged releases, defaults parity, marker constants

[mmcky]

@v0 is both the production pointer and the E2E canary, so a release cannot be smoke-tested before every consumer gets it — and the release checklist requires a human to move two floating tags by hand. copilot-instructions.md records that @v0 went stale for nine releases once.

PR-body metadata carries a schemaVersion that is write-only: the parser has no version handling, and every parse failure is silent. PRs opened by older versions stay open and must keep parsing forever.

Adds release.yml, a v0-next staging tag, a v0 assertion, an action.yml-defaults parity test, marker constants, and normalizeDocsFolder().

Findings covered

10 audit findings land here. F<n> are stable references into the audit; rank is the report ordering (1 = act first of 139).

• F93 · rank 8 · low · t/m — docs-folder join emits lectures//pv.md; rebase's overlap check finds nothing and silently declines to rebase a conflicting PR
• F51 ½ · rank 80 · med · s/s — createTranslationPR's ~130-line API body has no unit test despite being trivially fakeable
• F94 · rank 91 · med · s/s — Nothing couples action.yml's declared defaults to inputs.ts; v0.22.0 added a seventh duplicated pair
• F124 ½ · rank 95 · med · s/s — Nothing mechanically verifies the v0 tag moves on release — and the whole estate hangs off it
• F138 · rank 96 · med · s/s — @v0 is both the production pointer and the only thing the E2E harness can exercise
• F30 · rank 97 · low · s/s — Releasing is a six-step hand ritual, two force-moved tags, the version hand-copied into four places
• F125 · rank 98 · med · s/s — Deterministic gates are unverified instruments: validateMyST has no test at all, and its docs describe behaviour it lacks
• F6 ½ · rank 120 · low · s/s — Review mode ignores the target-language input it documents as required, deriving language from a repo-name regex
• F90 ½ · rank 121 · low · s/s — The same: an explicitly set value is silently discarded
• F127 ½ · rank 122 · low · s/s — The same; the silent-failure half is fixed (a core.warning now fires) — the remnant is docs and the scaffolded workflow

Plan

Estimate 2-3 days · Wave 2, step T6 · strict dependency order within the wave

release.yml, a v0-next staging tag, the v0 assertion, an action.yml-defaults parity test, marker constants, normalizeDocsFolder() in src/contracts.ts, review reads target-language.

---

_{From the technical-debt audit of 2026-07-23 (141 candidates adversarially verified, re-validated against v0.23.0, 139 live). Effort is stopgap / full — t≈0.5h, s≈3.5h, m≈11h, L≈28h. Items marked ½ were partially addressed by v0.22.0/v0.23.0.}

[mmcky]

This issue also closes #66

Recording the dependency here so it does not get lost, since it is an action on someone else's completion rather than on this issue's own checklist.

The metadata contract #66 asked for shipped in v0.22.0 — docs/user/metadata-contract.md exists on main, cites #66, and specifies both blocks, schemaVersion, and the breaking / non-breaking rules. #66 is deliberately being kept open as the origin for one residual: the consumer side. schemaVersion is currently write-only — the tri-state parser is F51/the version-handling work on this issue's list.

• On T6 completion, close feat: document translation-sync-metadata as a stable, versioned contract for downstream tooling #66 with a pointer to docs/user/metadata-contract.md and to the parser landed here.