feat: train v2 - release direct to master, drop release-PR machinery

[vreshch]

Why

The release-PR chain (branch -> PR -> auto-merge -> self-approve action_required CI -> poll merged) broke three different ways in three weeks: the repo auto-merge setting, the approval gate, and a guard field bug. The side estate's v2 trains (direct commit to master, no PRs) went 6/6 green on first soak. This drops the fragile delivery machinery and keeps everything else.

Kept unchanged

• Friday cron slot and workflow_dispatch
• the dependabot-quiescence wait job
• releasable-commit detection and the skip logic, wording intact - every skip still prints its reason to $GITHUB_STEP_SUMMARY
• always-minor bump computation
• npm run verify before anything reaches master
• explicit dispatch of release.yml (a GITHUB_TOKEN push fires no push trigger)

Removed

• release/X.Y.Z branch + gh pr create + gh pr merge --auto
• the "Skip if an open release PR exists" guard, and every if: steps.guard... that hung off it (the stuck-open-PR state it guarded no longer exists)
• the self-approve action_required runs step
• the wait-for-the-PR-to-merge poll

Added - fail-closed completion

• git commit -> git pull --rebase origin master -> git push origin HEAD:master. A rejected push is a red run, never a force.
• the dispatched publish run is polled to conclusion: a red publish is now a red train instead of a green train with a stranded bump on master
• the published artifact is asserted before the train goes green
• concurrency: group: train takes over the overlap protection the open-PR guard used to provide
• release job timeout-minutes 30 -> 60 to cover the publish wait

Verified

actionlint (1.7.7) is clean apart from the two pre-existing info-level shellcheck notices that the current file already emits (identical set before and after).

Rollout

Merge, then next Friday's scheduled run is the soak. There is no dry run short of cutting a real release; a repair is a workflow_dispatch on the train, which re-detects and skips cleanly if nothing is releasable.

server-memory specifics

• the npx npm-check-updates -u --target minor --dep prod,dev --filter "@agentage/*" step landed tonight and is preserved verbatim, along with the L1 "dep change alone justifies a release" decide step
• npm run verify against the bumped memory-core is still the integration gate, and it now runs before anything reaches master rather than before a PR merge
• completion assert is npm only (@agentage/server-memory@X.Y.Z); release.yml publishes and tags, nothing else