ci: publish Behavior Diff releases to marketplace

[kentwelcome]

Summary

• Add a stable GitHub Release workflow that reuses deterministic CI and validates the qualified release tag, main ancestry, and both plugin manifests.
• Update the Spacedock marketplace through a tested JSON updater and a dedicated write-enabled deploy key, pinning both version and source.ref.
• Document the release steps and remove stale README text about marketplace availability, run approval, modes, and counts.

Security and operations

• Workflow permissions remain contents: read in Behavior Diff.
• Cross-repository writes use the dedicated MARKETPLACE_DEPLOY_KEY, not a personal token.
• Marketplace pushes are non-force and protected by a mutation-tested contract.
• The marketplace deploy key and Behavior Diff Actions secret are provisioned.
• Drafts and prereleases do not update the stable marketplace.

Test plan

• docker run --rm -v "$PWD:/mnt" -w /mnt mvdan/shfmt:v3.14.0 -d -i 2 -ci .
• uvx ruff@0.16.5 format --check --diff .
• Bash syntax checks for all shipped and test scripts
• ShellCheck for the changed release scripts
• Python syntax checks
• rhysd/actionlint:1.7.7
• bash tests/hooks-test.sh
• python3 plugin/skills/behavior-diff/scripts/decisions.py --check
• bash tests/live-report-contract.sh
• bash tests/release-workflow-test.sh
• claude plugin validate plugin
• git diff --check

Review

• Independent repository review: APPROVE

Generated with OpenAI Codex

[Copilot]

🟡 Changes recommended

There are a couple of concrete secret-safety hardening issues (deploy key file creation permissions and predictable temp file naming) that should be addressed before merging.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR adds a stable GitHub Release-driven publication flow for Behavior Diff, reusing deterministic CI and updating the Spacedock marketplace entry in a controlled, test-validated way, while also updating operator-facing documentation.

Changes:

• Add a release.published workflow that reuses CI, validates release tags/manifests, and pushes a pinned marketplace update via deploy key.
• Add a deterministic shell updater + contract test to enforce marketplace mutation and workflow safety invariants.
• Update README/operator docs and verification docs to reflect the new release process and checks.

File summaries

File	Description
.github/workflows/release.yml	New Release workflow: validates tag/manifests/main ancestry, then updates marketplace via deploy key.
.github/workflows/ci.yml	Makes CI reusable via workflow_call and runs the new release workflow contract test.
.github/scripts/update-marketplace.sh	Adds a deterministic JSON updater for marketplace version + source.ref.
tests/release-workflow-test.sh	Adds a contract test covering updater behavior and workflow security/structure invariants (incl. non-force push).
README.md	Updates install/usage text and documents the operator release steps.
AGENTS.md	Adds tests/release-workflow-test.sh to the documented deterministic suite.
CODING_GUIDELINES.md	Updates verification commands to include new scripts and the release workflow test.
plans/2026-09-02-plugin-release-process.md	Adds an implementation plan for the release workflow + marketplace updater + ops steps.
plans/2026-09-02-plugin-release-design.md	Adds the release design/contract describing workflow behavior and constraints.

Review details

• Files reviewed: 9/9 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.