chore: drop beta channel — trunk-based only (#450)

[olegbrok]

Summary

Final cleanup PR for Phase 1 of the trunk-based migration (#450). With beta and main now converged and tag 26.05.070 cut, this PR removes the beta channel from the codebase.

Changes

src/pinky_daemon/api.py — channel cleanup

• GET /admin/channel: always returns {channel: "stable", branch: "main"}. Legacy PINKYBOT_CHANNEL=beta env is logged + coerced to stable.
• POST /admin/channel: only "stable" accepted; other values → 400.
• POST /admin/update: rejects branch=beta (or any non-main value) with 400. Empty branch defaults to main. use_release_tags is now unconditionally True — production always pulls the latest release tag.

.github/workflows/release.yml — NEW manual release workflow

• workflow_dispatch with version input (calver YY.MM.NNN, e.g. 26.05.071) + optional release notes.
• Validates format + branch (must be main).
• Creates annotated tag, auto-generates release notes from commits since prior tag, publishes GitHub Release.
• Existing docker-publish.yml already triggers on 26.* tags → no change needed there for tag publishing.

CI workflows — drop beta branch filters

• ci.yml, codeql.yml, docker-publish.yml: removed beta from branches: filters (no more beta branch to test).

CLAUDE.md — Deploy section updated

• Single-channel doc + reference to the manual Release workflow.

Tests

TestTrunkBasedChannel class added to tests/test_admin_update.py:

• branch=beta → 400
• arbitrary branch → 400
• empty branch → defaults to main (release tags)
• PINKYBOT_CHANNEL=beta env → coerced to stable, still pulls main
• GET /admin/channel always returns stable/main regardless of env
• POST /admin/channel?channel=beta → 400

All 28 admin-update tests pass locally (pytest tests/test_admin_update.py). Lint clean.

After merge

• Tag 26.05.070 is already on main (cut earlier from Release: beta → main (Phase 1 trunk-based migration + watchdog + federation) #453 merge).
• Next release: trigger the Release workflow with version 26.05.071 (or whatever's next).
• The beta branch on GitHub can be archived or deleted at Brad's leisure — nothing in CI references it anymore.
• Production hosts running PINKYBOT_CHANNEL=stable (the only channel) keep working transparently. Any host that somehow has PINKYBOT_CHANNEL=beta will log a deprecation warning and behave as stable.

Test plan

• CI green
• Verify the Release workflow appears in the Actions tab post-merge (workflow_dispatch only)
• First post-merge release dry-run: trigger Release workflow with a test version on a feature branch (will fail the "must run from main" guard — expected)

🤖 Opened by Barsik