Fix agent scan/get skipping apply for recorded patches (#454) - #456

…GELOG sync/fold, blocker gate) (#643)

* Add scripts/release.py: release-train stamp, versions, CHANGELOG, blockers

PR 1 of the weekly release train (docs/release-train/DESIGN.md §7). One
stdlib-only Python file with argparse subcommands:

- stamp <V> [--check]: offline, byte-deterministic version stamp of
  Cargo.toml (workspace version + =V core pin), Cargo.lock (source-less
  workspace-member entries, so --locked builds), the 15 npm manifests and
  npm/socket-patch/package-lock.json (JSON edit; platform entries for any
  other version are dropped instead of re-resolved over the network, which
  ends the #233/#235 lock-drift class).
- semver: X.Y.Z and X.Y.Z-rc.N only, semver precedence.
- next-version: from git tags + burned release/* branches + the
  [Unreleased] headings of sync-main(C) computed in memory, never from
  main's Cargo version. New majors need APPROVED_MAJORS (5 is
  pre-approved) and are never skipped; otherwise refused with an error.
- changelog cut|promote|sync-main|check: rc sections reach main on every
  rc; promotion folds rc.1..rc.K into one [X.Y.Z] section and returns
  later abandoned rc blocks to [Unreleased]. Exact-match, deterministic,
  idempotent; newer [Unreleased] entries are never touched.
- notes: release notes with a link to the open-P1 query, never titles.
- blockers --base <sha>: the §3.5 release-blocker rule over REST
  (injectable transport); any API error blocks.

Tests: scripts/tests/test_release.py with temp git repos driven through
the train timeline and recorded REST shapes under
scripts/tests/fixtures/release/.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Stamp versions offline and let release-lint accept rc versions

- scripts/version-sync.sh is now a thin wrapper over `release.py stamp`
  (same CLI contract; also stamps Cargo.lock's workspace entries). On the
  clean tree `version-sync.sh 4.0.0` is a byte no-op.
- scripts/release-lint.sh: the grammar accepts X.Y.Z and X.Y.Z-rc.N;
  check 2 is `release.py stamp --check` (byte compare, offline, no
  clean-tree requirement, writes nothing); check 3 is `release.py
  changelog check` (rc sections; a stable fails while rc sections remain
  unfolded); new --stable-only and --tag-exists.
- ci.yml release-readiness: the rolling `release-sync` PR (which moves
  main to the newest cut tag, rc or stable) runs `release-lint.sh
  --tag-exists`; every other PR keeps today's behavior.
- release.yml (legacy pipeline until the train replaces it): lint with
  --stable-only so it can never publish an rc as Latest/npm latest.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Remove the version-bump workflow and bump-version.sh

version-bump.yml's unsigned push is rejected by the main ruleset and it
never ran; the release train cuts versions with scripts/release.py
instead. The CHANGELOG header and docs/releasing.md now point at
docs/release-train/DESIGN.md (the full runbook rewrite is PR 4), the
interim manual bump uses `release.py changelog cut` + version-sync.sh,
and ci.yml stops shellchecking the deleted script.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Add the release-train design with maintainer decisions D1-D4

D1: GitHub App socket-patch-release + refs/tags/v* ruleset (App-only
bypass); the App mints the tag in the publish job (PR 3). D2: version and
CHANGELOG reach main on every rc via the release-sync PR, folded at
promotion. D3: routines run as mikolalysenko (a routine actor, not an
approver) until a bot exists; npm stable is direct OIDC; newest-line
hotfixes only. D4: the first train release is 5.0.0 (pre-approved major).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Fix PR 1 review findings in release.py, release-lint and the CI gate

CHANGELOG (sync-main / cut / promote):
- The fold no longer classifies rc sections by rc number. Every rc
  section whose core shipped is replaced by its blocks (tag text) minus
  [S]'s blocks, as a multiset shared with the [Unreleased] removal. A
  train rc cut beside a same-core hotfix now returns its entries instead
  of losing them, whichever was cut first. TagSource.promoted_from is gone.
- Matching counts occurrences: a shipped block removes one occurrence,
  so a repeated entry ("- Updated dependencies.") survives an unmerged
  sync PR and no longer changes the bump level.
- Returned blocks go before the blocks already in their subsection, and
  a cut orders its ### subsections canonically (breaking, then Keep a
  Changelog, then the rest). The next cut is now byte-identical with or
  without the sync PR, including subsection order left by shipped history.
- CRLF CHANGELOGs round-trip, and every generated line uses CRLF.

Blocker gate:
- Fails closed unless GET /labels/release-blocker returns that exact
  name. Label names compare case-insensitively. labeled events since L
  are candidates, and a label that vanished without an unlabeled event
  still blocks. Deleted, converted and transferred issues block.
- RELEASE_APPROVERS / RELEASE_ROUTINE_ACTORS split on commas and
  whitespace and accept a leading @. A malformed login, an empty list, or
  no trusted approver blocks with a config error, in cmd_blockers and in
  evaluate_blockers.
- since = committer date of merge-base(L, base), clamped to the base
  date, not a forgeable tag date. A since later than the base fails
  closed.
- PR-merge closes (closed event with commit_id null, recorded from #454)
  resolve through the closing PR's merge_commit_sha being in base.
- Malformed event shapes fail closed.

Lint / CI:
- release-lint check 2 also runs the new offline `release.py
  npm-lock-check`: the wrapper lock's packages[""] must match
  package.json, and every non-optional dependency needs a node_modules
  entry. This restores the dependency-drift check the networked lock
  refresh used to give.
- ci.yml takes the release-sync --tag-exists path only for a same-repo
  release-sync branch into main.
- rel.Git ignores GIT_DIR/GIT_WORK_TREE and similar variables.

Tests:
- StampTests are hermetic: they run on a temp tree stamped to a fixed
  baseline (4.0.0, and 5.0.0-rc.1 via a subclass), so the suite passes on
  main after the release-sync PR.
- The temp repos ignore the git env and global config.
- New coverage: release-lint (plain and --tag-exists) on a sync-main'ed
  tree at an rc, the CI gate step run with stubs, and a regression test
  for each finding.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* DESIGN.md: align with the PR 1 review fixes

- §1: rc.2's section is synced to main and its unshipped blocks return
  to [Unreleased] when the stable is synced.
- §2: the release.py list adds semver, npm-lock-check, next-version and
  changelog.
- §3.1: U = [Unreleased] of sync-main(C) computed in memory (this
  replaces the pre-D2 "minus L's section" rule).
- §3.4: hotfix cuts use --no-sync, and same-core train rcs return to
  [Unreleased].
- §3.5: the label check, case-insensitive names, labeled-event
  candidates, vanished labels and gone issues, the merge-base `since`,
  strict config parsing, and PR-merge close resolution.
- §3.7: multiset fold, chronological returns, canonical cut order,
  CRLF, and the same-repo-only release-sync CI path.
- §4: npm-lock-check and the ci.yml condition.
- §5 I1 and PR 4: the stable tree is stamp + promote (fold), not a
  heading rename.
- S5: the release-blocker label must exist before the gate can pass.
- §7 PR 1: the accept list adds the new scenarios.
- §8: APPROVED_MAJORS is kept (D4), and multiset counting is kept.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Fix PR 1 re-review findings: multiset fold, since lookback, CRLF stamp

- promote keeps every occurrence when folding rcs, so [X.Y.Z] is the
  multiset sum of its rcs and sync-main charges them with the same count
  (a repeated entry no longer returns as unshipped or raises the bump);
  a later abandoned rc returns all of its blocks.
- sync-main charges the rc sections on main against [S] before removing
  the rest of [S] from [Unreleased], so a newer identical entry keeps its
  place whether or not the release-sync PR merged.
- blockers: since is never later than base - 35 days, so a forged high
  stable tag at the base cannot shrink the candidate window further; S9
  is a hard prerequisite for live gate runs.
- blockers: a PR-merge close resolves only through PRs merged by the
  close actor (merged_by.login, recorded for #456).
- stamp keeps each file's line endings (CRLF checkouts check clean).
- sync-main computes CHANGELOG and stamp before writing anything.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Fix release lint assertions under GitHub Actions

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>