release: the auto-Release job from #124 has never run on a real tag — v0.3.0 GitHub Release was hand-created before #124 merged

[yakimoto]

Symptom

The auto-Release job added in #124 has never executed against a real tag. The GitHub Release
that exists for v0.3.0 was hand-created by a human before #124 merged, so the automation it
represents is entirely unproven. The repo looks like it has a release pipeline; nothing has ever
demonstrated that it does.

Repro / Evidence

$ gh api repos/wave-av/mcp-server/releases/tags/v0.3.0
# author:       yakimoto        <- a human, not github-actions
# published_at: 2026-09-06T19:18:06Z
# assets:       0               <- the automation's whole output is absent

Timeline:

• 2026-09-06T19:18:06Z — v0.3.0 Release published, author yakimoto, 0 assets.
• 2026-09-06T19:37:26Z — ci(release): create GitHub Release after successful npm publish (VER-001) #124 merged. The Release predates the automation by ~19 minutes.
• publish run 34054287316 — the verify job failed on the pre-fix(release): verify tools/list against capabilities.json, not a literal 18 (v0.3.0 verify red on 24 tools) #128 assertion. Because the
  release job declares needs: [publish, verify-publish], it was skipped, never run.

So there is no run in which the release job has produced a Release, and the one Release that
exists is a hand-made artifact with none of the expected assets. This is
absence-rendered-as-health: a green-looking tag with a Release attached, where the job that was
supposed to create it has never once fired.

Why this matters

The next tag is the first real execution of an untested job, at exactly the moment when a failure is
most expensive (a published npm version with no corresponding GitHub Release / assets). And the
claude-workstation release ledger currently has no way to distinguish "automation worked" from "a
human filled the gap."

Done-check

• The next tag (v0.3.1 or later) produces a GitHub Release whose author is
  github-actions (verify: gh api repos/wave-av/mcp-server/releases/tags/<tag> --jq '.author.login, (.assets|length)') carrying the expected assets (non-zero, and matching what
  the release job in ci(release): create GitHub Release after successful npm publish (VER-001) #124 is specified to upload).
• The release job actually ran (not skipped) in that tag's workflow run — paste the run URL
  and the job conclusion.
• node scripts/verify-release-ledger.mjs in wave-av/claude-workstation reads PASS for
  mcp-server.

A green publish run alone is not the receipt — release was skipped in 34054287316 while the run
still existed. The receipt is the Release object's author + asset count.