[ShutenOishi]

Phase 1 of fleet-wide 14-extension manual-only migration. No formal Release is being created.

• Remove release/** from Windows CI push triggers and delete release_build/automatic release jobs; these permitted a publication on a release branch without explicit operator PUBLISH.
• Keep read-only Windows CI for PR/main/manual and the existing candidate verification on SHA-pinned candidate dispatch.
• Do not weaken mandatory PG14–18 Windows CI, branch protection, GitHub App grants or existing public artifacts.
• Staged migration only: until a production-tested main-only manual promote.yml and shared generalized source/attestation guard are ready, merging this PR temporarily leaves formal new Releases blocked. Do not merge it in isolation without an accepted replacement publication route and successful exact-head native CI.
• Explicit decision: no unattended formal Release; no separate human reviewer/approval JSON; human operator must consciously dispatch confirm_release=PUBLISH.

Migration evidence is tracked in build Issue #61.

[ShutenOishi]

Formal-Promotion source pin audit (2026-10-11)

The local migration branch now also pins the existing upstream ref(s) to exact Git commit SHA (never annotated tag-object SHA):

• v1.6.8=5cedfa472ccc83567aa23ec645925ed8489a7797 (peeled annotated tag)

These pins were obtained by inspecting the upstream Git tag refs, following annotated tags to commit objects where necessary. This resolves the generalized fleet-promotion-gate.py / fleet-publish-release.py strict sources(require_pins=True) precondition. The PR also removes old release/* auto-publication and adds main-only operator-confirmed PUBLISH Promotion. PR remains UNMERGED until its current head SHA's required PG14–18 CI succeeds. No formal Release, Git tag or downstream Catalog/Website change was initiated.