feat: automatic version cut on ship with fixed cut-push-publish sequencing

[utx0]

Summary

Makes version cutting an automatic, default-on part of the ship step, governed by release.on_ship (auto | prompt | off, default auto), and fixes the --github sequencing failure that broke the GitHub release on both v0.5.0 and v0.6.0.

• Config: ReleaseConfigSchema gains on_ship (Zod .default('auto'), three-legged default-on pattern like uat.enforce_on_ship) and allow_major_pre_1 (default false). metta install scaffolds the release block explicitly when package.json exists.
• Ship-path skills (metta-ship, metta-propose --ship opt-in, metta-quick, metta-auto, metta-fix-issues, metta-fix-gap): after the user-approved PR merge + main fast-forward, a canonical byte-identical post-merge release stage runs release status --json → derives the bump → metta release cut --bump <level> --yes --json → tag rides the single authorized git push --follow-tags origin main → only when github_release: true, gh release view probe then gh release create <tag> --verify-tag --notes-file -. Warn-and-continue: no failure blocks or unwinds a completed ship.
• Fixed sequencing: ReleasePipeline.cut() is now purely local — the in-cut gh call and gh-release.ts are deleted; --github is an erroring stub pointing at the fixed sequence. --verify-tag closes gh's silent wrong-tag creation (the actual v0.5.0/v0.6.0 corruption mode). cut --json emits the extracted changelog notes; status --json echoes onShip/allowMajorPre1/githubRelease.
• Safety rails: pre-1.0 derived MAJOR downgrades to minor in auto mode (escape hatch allow_major_pre_1: true); prompt mode fails closed non-interactively; absent release config skips with a one-line notice; tokens/UAT/gates untouched.
• Guard/mint: single delta — metta-fix-gap mint scope gains release:cut; fork-tier ship skills were already authorized. No guard table changes.
• Tests: new tests/skill-release-ship-stage.test.ts grep-assert suite (57 assertions, mutation-check proven); full suite 2873 passed / 0 failed; tsc --noEmit clean; all 34 spec scenarios evidenced.
• Review: 3 parallel reviewers (correctness/security/quality) — all PASS_WITH_WARNINGS, zero criticals; two warning fixes applied in-change.

UAT results

Result: 22 pass / 0 fail / 46 skip (of 68 steps) — PASS
Run: 2026-08-26 · record committed as docs(automatic-version-cut-ship-user-decision-2026-08-26-make): UAT run record (b759e6a) · spec/archive/2026-08-26-automatic-version-cut-ship-user-decision-2026-08-26-make/UAT.md

Skipped — needs manual acceptance

Step	Reason
1.1, 1.2, 3.1–3.3, 7.8, 7.10, 7.11, 7.15, 7.16, 7.21–7.24, 7.26, 7.30, 7.31	require a live ship-path skill run completing a real PR merge/push
2.1–2.4, 7.17–7.20	require an interactive (or live non-interactive) prompt-mode ship session
4.1, 4.2, 7.12, 7.13, 7.33, 7.42, 7.44, 7.46–7.49	require live gh/GitHub-remote interaction during a real cut/publication
5.1–5.3, 7.27–7.29	pre-1.0 guard is skill-instruction-driven at ship runtime; wording verified present in all six templates
7.9	requires a live metta-propose run (opt-in scoping asserted by the passing test suite)
7.41	mutation of a tracked skill file is forbidden for the UAT runner

🤖 Generated with Claude Code

https://claude.ai/code/session_01AA8wwFpob25iYZFCBBEtKK