docs(cut-release): rewrite the skill for the Actions pipeline, all three harnesses

[stozo04]

The release became two dispatched workflows in #182–#187, but cut-release/SKILL.md still described the seven-step local walkthrough. Left alone it would send the next agent — on any of the three harnesses — to run a sweep that no longer gates anything and to hand-build an AAB the pipeline already built.

Rewritten in .claude, .cursor and .codex. All three blobs hash to f7e9e12, so they're byte-identical and gate 6d compares clean; this file has no self-referencing harness path, so no per-tree substitution was needed.

What changed

• Stop A is gone. The workflow merges its own bump PR. Recorded as a deliberate owner decision so a future agent doesn't read it as an oversight and reinstate a review gate.
• Stop B is the only hard stop, and now the only manual step in the entire release.
• A section on why the sweep doesn't run on a release bump — a two-line integer change can't affect JVM tests, lint or spelling, and every commit the release carries was already swept on its own PR. The release-variant build is what a release actually adds as a gate. Written to be argued with rather than obeyed, since the next agent will otherwise "helpfully" add it back.
• Detect-the-stage rewritten around workflow runs instead of local artifacts, including how to resume when a run fails after the bump has already merged.
• Prerequisites — the five signing secrets, plus RELEASE_TOKEN and why only a real run needs it.
• Manual fallback kept, framed as an incident rather than an alternative, so two paths don't quietly stay in use.
• Final verification still exactly two checks, but the bundle now lives in the run's artifacts rather than releases/.

Both owner calls are preserved: the 2026-08-28 vitals scope decision verbatim, plus a new 2026-09-07 entry recording the automation decisions.

Not done here

docs/play-store/release-signing-and-aab.md and DEFINITION_OF_DONE.md still describe the manual sequence. They're not wrong — the fallback section points at them — but they'd read better with a note that the pipeline is the primary path. Worth a follow-up once a real release has run end to end.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Miqsf1M14nY5TKiZHzyjNY

---

Note

Low Risk
Documentation-only change to agent skills; no runtime or CI behavior is modified in this PR.

Overview
Rewrites the cut-release skill in .claude, .cursor, and .codex (byte-identical) so agents follow the Actions pipeline from #182–#187 instead of the old seven-step local flow (manual bump, sweep, local bundleRelease, local tag-release.ps1).

The skill now centers on two dispatched runs: release.yml (bump + self-merge PR, signed AAB artifact, notes) and tag.yml (tag after Play upload). Stop A (approving review on the bump PR) is removed as an explicit owner decision; Play upload confirmation remains the only hard stop before tag.yml. New sections cover why pre-pr-sweep does not run on version bumps, resume logic from gh run list / failed runs (including dry_run after a post-bump failure), RELEASE_TOKEN and signing secrets, manual fallback as incident-only, and final verification against workflow artifacts instead of releases/. The 2026-08-28 vitals scope call is kept; a 2026-09-07 owner call records automation choices.

^{Reviewed by Cursor Bugbot for commit 63cfa46. Bugbot is set up for automated code reviews on this repo. Configure here.}