ci(release): remove the tag-push release workflow

.github/workflows/cli_release.yml

@@ -30,8 +30,8 @@ on:
 # Shares the server release/deploy group: both release flows push to
 # main, so running them at once can reject one push. A run dispatched
 # while a server release is in flight queues until it's done.
-# GitHub keeps one queued run per group, so any later run in the group (a
-# release or deploy dispatch, or a v* tag push) cancels the queued one.
+# GitHub keeps one queued run per group, so a later release or deploy
+# dispatch cancels the queued one; dispatch the cancelled run again.
 concurrency:
   group: deploy-prod
   cancel-in-progress: false

.github/workflows/manual_release.yml

@@ -21,10 +21,10 @@ on:
         type: boolean
         default: false
 
-# Shared with the other release workflows, which also push to main, and
-# the deploy workflows. GitHub keeps one queued run per group, so any
-# later run in the group (a release or deploy dispatch, or a v* tag push)
-# cancels the queued one.
+# Shared with cli_release.yml, which also pushes to main, and with
+# force_deploy.yml and test_deploy.yml, which deploy to the same instance.
+# GitHub keeps one queued run per group, so a later release or deploy
+# dispatch cancels the queued one; dispatch the cancelled run again.
 concurrency:
   group: deploy-prod
   cancel-in-progress: false

.github/workflows/publish-registry.yml

@@ -29,10 +29,9 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false # publish reads server.json only; don't persist the token to .git/config
-          # The bumped commit is tagged before this job runs in both release
-          # paths (auto_release is triggered by the tag; manual_release pushes
-          # the tag in bump-and-tag, which deploy + this job depend on), so the
-          # tag always resolves to the version-bumped server.json.
+          # manual_release.yml pushes this tag in its bump-and-tag job before
+          # it calls this workflow, so the tag should resolve to the
+          # version-bumped server.json; the next step stops the run if not.
           ref: v${{ inputs.version }}
 
       - name: Verify server.json version matches release

CONTRIBUTING.md

@@ -224,18 +224,13 @@ the allowance states why.
 
 ## Release Process
 
-Releases are cut by the maintainer, in one of two ways:
+Releases are cut by the maintainer: Actions tab → "Manual Release" → choose
+`patch`/`minor`/`major`. The workflow bumps the version, deploys, and creates
+the GitHub Release.
 
-- **Manual Release:** Actions tab → "Manual Release" → choose
-  `patch`/`minor`/`major`. The workflow bumps the version, deploys, and
-  creates the GitHub Release.
-- **Tag push:** merge a version-bump PR into `main`, then run
-  `git tag v<version> && git push --tags`. The tag push deploys and creates
-  the GitHub Release.
-
-Direct commits to `main` are blocked by a branch ruleset — all changes, a tag
-push's version bump included, land via PR. Only the release workflows push to
-`main` directly, for their version-bump and CHANGELOG commits.
+Direct commits to `main` are blocked by a branch ruleset — all changes land
+via PR. Only the release workflows push to `main` directly, for their
+version-bump and CHANGELOG commits.
 
 The CLI releases separately: Actions tab → "Release CLI" (see
 [The `cli/` Package](#the-cli-package)).
@@ -249,11 +244,12 @@ What each release's notes list:
     change only `devDependencies` or `overrides` in the root `package.json`,
     and in `package-lock.json` only packages marked `"dev": true`
   - Claude Code hook changes (commit scope `hooks`)
-  - commits that change only `AGENTS.md`, `CHANGELOG.md`, dotfiles at the
-    repository root (`.gitignore`, `.trivyignore`; not `.dockerignore`, which
-    decides what the image build copies, or `.env.example`, which DEPLOY.md
-    has deployers copy), or files under `.claude/`,
-    `.devin/` or `.husky/`
+  - commits that change only these files:
+    - `AGENTS.md` and `CHANGELOG.md`
+    - dotfiles at the repository root, such as `.gitignore` and
+      `.trivyignore`, except `.dockerignore` (it decides what the image
+      build copies) and `.env.example` (DEPLOY.md has deployers copy it)
+    - files under `.claude/`, `.devin/` or `.husky/`
 - **CLI releases** (`.github/scripts/generate-cli-notes.sh`): every commit
   that changes `cli/`, including dependency bumps that edit
   `cli/package.json`, except commits whose added and removed lines under