ci: Friday release train (L2, @agentage dep-bump)

[vreshch]

Fully automated Friday MINOR release train for @agentage/cli, replacing the manual release-prepare.yml.

What

• New release-train.yml (supersedes release-prepare.yml, removed): scheduled Friday, auto dep-bump + minor bump + verify + auto-merge PR + explicit publish.yml dispatch. No human step on the happy path.
• Level 2 timing: depends on @agentage/memory-core + @agentage/server-memory (release 20:00/21:00 Prague), so this train runs at 22:00 Prague. Crons 0 20 * * 5 + 0 21 * * 5; gate proceeds only when TZ=Europe/Prague date +%H == 22 (DST-proof).
• Internal dep bump: npx npm-check-updates -u --filter '@agentage/*' + npm install before the version bump. Dep changes alone justify a release; skips only when neither releasable commits (excl. docs/ci/plain-chore; chore(deps) counts) nor dep changes exist.
• Always minor bump via scripts/bump-version.js minor.
• npm run verify after the dep bump is the integration gate (red = fail without releasing).
• Post-merge dispatches publish.yml (gh workflow run --ref master) since GITHUB_TOKEN merges don't fire push triggers. permissions: actions: write.
• Dependabot-quiescence stays wait-only (org triage owns merging).

Bug fixes

• release-prepare 401: old flow depended on RELEASE_PAT || PAT_TOKEN || GITHUB_TOKEN + origin re-auth to fire downstream checks. New train uses plain GITHUB_TOKEN with the --auto --squash -> direct-squash 'clean status' fallback + explicit publish dispatch, removing the PAT dependency entirely.
• publish.yml release-gate regex: verified it already matches ^chore\(release\) (and workflow_dispatch always allows) - no change needed; the train's commit subject chore(release): X.Y.Z passes it.

Dependabot

• Removed the org-forbidden ignore semver-major rule; config now matches org standard (weekly Fri 18:00 Europe/Prague, assignees ['vreshch'], group '*', limits 10 npm / 5 gh-actions).

Verified locally: npm ci + npm run verify green; all YAML yaml.safe_load-valid.

[github-actions]

🎉 PR Validation ✅ PASSED

Commit: 7690de26ef799e1252dfe09b89cf66329276113d
Branch: ci/friday-release-train

Checks:

• ✅ Release guard (no version/changelog changes)
• ✅ Dependencies installed
• ✅ Type check passed
• ✅ Linting passed
• ✅ Format check passed
• ✅ Tests + coverage passed
• ✅ Build successful

Ready to merge! ✨

---

🔗 View workflow run
⏰ Generated at: 2026-07-29T23:12:24.602Z