[rteoo]

Summary

• Guarded Python release helper and docs; remove the duplicate release-published workflow trigger.
• Requires a clean checkout of main matching origin/main, an already-merged manifest version, and an exact vX.Y.Z tag.
• Dry-run executes local gates without mutating GitHub; real mode pushes only the tag and creates the release at the verified immutable commit.

Testing

• Focused release flow tests: 17 passed.
• Python compilation and staged diff checks passed.
• No tag, release, deployment, dependency installation, or hosted workflow was run.
• Secret scanners were unavailable on this host; staged files were manually reviewed for credentials.

Risks

• This PR does not deploy production; repository-specific production gates remain required.
• Native hosted runners and external package/service behavior were not exercised locally.