feat: train v2 - release direct to master, drop release-PR machinery

[vreshch]

Why

The release-PR chain (branch -> PR -> auto-merge -> self-approve action_required CI -> poll merged) broke three different ways in three weeks: the repo auto-merge setting, the approval gate, and a guard field bug. The side estate's v2 trains (direct commit to master, no PRs) went 6/6 green on first soak. This drops the fragile delivery machinery and keeps everything else.

Kept unchanged

• Friday cron slot and workflow_dispatch
• the dependabot-quiescence wait job
• releasable-commit detection and the skip logic, wording intact - every skip still prints its reason to $GITHUB_STEP_SUMMARY
• always-minor bump computation
• npm run verify before anything reaches master
• explicit dispatch of release.yml (a GITHUB_TOKEN push fires no push trigger)

Removed

• release/X.Y.Z branch + gh pr create + gh pr merge --auto
• the "Skip if an open release PR exists" guard, and every if: steps.guard... that hung off it (the stuck-open-PR state it guarded no longer exists)
• the self-approve action_required runs step
• the wait-for-the-PR-to-merge poll

Added - fail-closed completion

• git commit -> git pull --rebase origin master -> git push origin HEAD:master. A rejected push is a red run, never a force.
• the dispatched publish run is polled to conclusion: a red publish is now a red train instead of a green train with a stranded bump on master
• the published artifact is asserted before the train goes green
• concurrency: group: train takes over the overlap protection the open-PR guard used to provide
• release job timeout-minutes 30 -> 60 to cover the publish wait

Verified

actionlint (1.7.7) is clean apart from the two pre-existing info-level shellcheck notices that the current file already emits (identical set before and after).

Rollout

Merge, then next Friday's scheduled run is the soak. There is no dry run short of cutting a real release; a repair is a workflow_dispatch on the train, which re-detects and skips cleanly if nothing is releasable.

cli specifics

• the last-tag/version anchoring in "Detect releasable commits" is byte-for-byte unchanged: it deliberately anchors on the package.json version line because the stale v0.24.x tags are semver-max
• the npx npm-check-updates -u --target minor --dep prod,dev --filter "@agentage/*" step landed tonight and is preserved verbatim
• the explicit release.yml dispatch stays mandatory: its dispatch path is the only route past the release-gate commit-message regex
• completion assert is npm only (@agentage/cli@X.Y.Z)

[github-actions]

🎉 PR Validation ✅ PASSED

Commit: bd8369729d15df47f59d5fdda56fbd5c9fd77a66
Branch: feature/train-v2-direct

Checks:

• ✅ Release guard (no version/changelog changes)
• ✅ Dependencies installed
• ✅ Type check passed
• ✅ Linting passed
• ✅ Format check passed
• ✅ Tests + coverage passed
• ✅ Build successful

Ready to merge! ✨

---

🔗 View workflow run
⏰ Generated at: 2026-08-21T23:54:56.887Z