ci(release): protect beta publication on master

[kattsushi]

Closes #230

Type

• Bug fix
• New feature
• Documentation only
• Code refactoring
• Maintenance/tooling
• Breaking change

Summary

• Prepare beta versions on an explicit release branch instead of pushing release commits directly to protected master.
• Suppress structurally valid release-PR merges and finalize publication only from an exact authorized master SHA.
• Add fail-closed workflow contracts, a maintainer runbook, and compact authoritative OpenSpec artifacts.

Changes

File	Change
.github/workflows/cd.yml	Add PREPARE, structural SUPPRESS, and exact-SHA FINALIZE paths while reusing Nx.
scripts/release-policy-contract.test.mjs	Cover branch-only preparation, dead-code resistance, tag/Release/npm conflict handling, and idempotent retries.
.github/SETUP.md	Document the protected beta recovery runbook and human gates.
openspec/changes/protect-branch-release-orchestration/	Preserve the compact proposal, spec, design, tasks, and apply evidence.

Test plan

• node --test scripts/release-policy-contract.test.mjs — 14/14 passed.
• Workflow YAML parses successfully.
• pnpm nx affected --target=lint --uncommitted --parallel=1 passed before commit.
• Repository format and git diff --check passed.
• Independent semantic verification found no blockers.
• Complete PR is 1,168 additions plus deletions, below the 1,200-line ceiling.

Contributor checklist

• Linked approved issue ci(release): respect protected master during beta publication #230.
• Added exactly one type:* label: type:chore.
• No standalone shell scripts changed; inline workflow shell is contract-tested.
• Documentation was updated with behavior changes.
• Commit uses Conventional Commits and has no Co-Authored-By trailer.
• No workflow dispatch, release version command, tag, GitHub Release, or npm publication occurred while preparing this PR.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e58c058a-eea3-46b0-bd4f-c934f57cfe4d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}