[samuel-williams-shopify]

Move releases to reviewed pull requests: bake gem:github:release:patch prepares the version and release notes, CI validates the proposed content, and a merged release triggers publication to RubyGems and GitHub.

Scaffolded with bake modernize:releases:github from bake-modernize 0.65.0, followed by bake gem:github:setup from bake-gem-github 0.6.0. The change replaces the direct bake-gem dependency, preserves the build and documentation tasks, adds the generated copyright-update hook, removes the duplicate GitHub-release hook, and updates the README command.

The generated configuration preserves certificate signing and selects the supported stable Ruby/platform checks, lint, validation, ASan, and Release validation. The proposed rules use the scaffold's default of two PR approvals, dismiss stale approvals, require the latest push to be approved, require up-to-date CI, and protect branch/tag history. These rules apply to all PRs into main when enabled; the review and check rules allow explicit administrator bypass. Environment reviewers are left unmanaged.

Validation

• Native extension build, Ruby syntax, and RuboCop: passed (65 files, no offenses).
• Generated YAML/JSON: parsed successfully; gem:github:setup:update returned no changes.
• gem:github:setup:plan: passed; read-only inspection confirmed the expected publisher settings and that the rubygems environment still needs creating.
• gem:github:release:validate base=77e0c72: passed for this migration commit.
• Unsigned gem build from a clean worktree: passed.
• Full suite on macOS / Ruby 4.0.7: 318 passed, 2 failed, 21 skipped. The same two KQueue process-wait failures reproduce on the unmodified base commit 77e0c72: “does not block the reactor while waiting for any child process” and “can wait for all child processes”. No runtime code changed.

Bootstrap after merge

1. Create a rubygems GitHub environment restricted to main and provide the GEM_SIGNING_KEY matching the committed release.cert.
2. Register the RubyGems trusted publisher with bundle exec bake gem:github:setup:publisher: owner socketry, repository io-event, workflow release-publish.yaml, environment rubygems.
3. Once the selected checks, including Release validation, have run, review bundle exec bake gem:github:setup:plan and enable the proposed policy with bundle exec bake gem:github:setup:apply.

This PR adds the proposed configuration only; no live rules, publishing credentials, or releases were changed. See the bake-gem-github setup documentation for release preparation and recovery instructions.

Independent of #233; both PRs target main.