Automate approved Zi milestone release flow

[ss-o]

Objective

Implement the approval-gated Zi milestone release flow authorized in
z-shell/.github#583.

Publication flow

1. After a promotion reaches main, compute the next semantic version from
   Conventional Commits since the latest vX.Y.Z tag and prepare draft notes.
2. Do not create a tag automatically.
3. Treat a maintainer-pushed annotated, signed tag as publication
   authorization.
4. Verify that the tag targets the exact current main commit, GitHub reports
   its signature as valid, and required workflows succeeded on that commit.
5. Publish an idempotent GitHub release with generated notes.

Acceptance criteria

• Add the minimal caller for the organization release-preparation workflow.
• Add a tag-triggered release workflow with explicit permissions and
  non-cancelling concurrency.
• Reject malformed, lightweight, unsigned, off-main, stale, or
  insufficiently validated tags before publication.
• Keep main as the stable Git-consumption boundary and avoid a stored
  version file.
• Validate the workflow with actionlint, YAML parsing, focused release
  verification tests, and git diff --check.
• Document the signed tag as the sole publication authorization.

Dependency

Blocked by z-shell/.github#583. Implementation begins after the policy
change is merged.

Related: #346, #467, v2.0.0

Triage

• Item Type: CI
• Impact: Medium
• Effort: M
• Priority: P2
• Workstream: Automation

[ss-o]

Agent handoff

Status: In progress
Repository: z-shell/zi
Branch/PR: next, PR #470
Tracker/Issue: #468

Current state

• Release automation is merged into next at d01d99feac8870415c60ee0a2a03f792f3c899bd.
• main remains at 38c63c274ce6bc4d05f5ab595c7731dd4eab9660, so the new workflows are not active yet.
• The preparation caller is pinned to merged policy commit 6f3d88335ca0ae77b795ec2883b4402b51f15c6a.
• Tag creation remains manual. A maintainer-pushed signed annotated tag is the sole publication authorization.

Verification

• All eight PR checks passed.
• Post-merge next CodeQL and Trunk runs passed.
• Focused verifier test passed for valid, malformed, lightweight, stale/off-main, unverified, API-target-mismatched, and failed-workflow cases.
• The verifier passed read-only against the real signed v2.0.0 tag, exact main target, and successful required workflows.

Blockers

• Activation intentionally waits for the next approved next to main promotion.

Next steps

1. Include PR feat(release): automate approved milestone publication #470 in the next promotion review and promote through the ADR-0019 merge-commit flow.
2. Confirm the Release Prepare workflow opens or updates the semantic-version proposal after that promotion.
3. When a milestone release is wanted, review the proposal and push the maintainer-signed annotated tag. The tag workflow will verify and publish the GitHub release.

[ss-o]

Completed by #508, merged to next.

Verified each acceptance criterion against what shipped rather than assuming:

Criterion	Where
Minimal caller for the org release-preparation workflow	release-prepare.yml:19
Tag-triggered workflow, explicit permissions, non-cancelling concurrency	release.yml: tags: ["v*.*.*"], contents: write, cancel-in-progress: false
Reject malformed, lightweight, unsigned, off-main, stale or under-validated tags	12 rejection checks in scripts/verify-release-tag.zsh
Keep main as the boundary, no stored version file	ZI[VERSION] from git describe --tags --exact-match
Validate with actionlint, YAML parsing, focused tests, git diff --check	tests/release-tag-verification.zsh; actionlint in .trunk/trunk.yaml
Document the signed tag as the sole publication authorization	added in #508

Only the documentation was outstanding. The flow itself has now also run end to end in production: v2.1.0 was published by the workflow, after the manual v2.0.1 exposed and fixed the missing Zsh install (#496, #497).

#508 also repairs an unrelated rendering defect found in the same file: docs/CONTRIBUTING.md opened its first fence with four backticks and the line that appeared to close it had three plus an info string, so lines 7 to 69 rendered as one code block and three section headings were displayed as preformatted text.

Closing here rather than on merge, since Closes only fires against the default branch and this landed on next.