Patch releases finalize from the release/X.Y branch itself, so the
previous local `./` reference loaded build-docker.yaml from whatever
branch triggered finalize-release.yaml. Pinning to @main keeps
job_workflow_ref stable across patch (release/X.Y-triggered) and
minor/major (main-triggered) releases, so Cloudsmith OIDC trust can
anchor on a single main-pinned claim instead of a release/* wildcard.

Docker images are published manually via build-docker.yaml's
workflow_dispatch trigger instead of automatically on release-PR merge.
Automating this required either a Cloudsmith OIDC claim that release/*
branches can't satisfy (Cloudsmith rejects wildcards) or loosening the
trust condition to accept any workflow calling build-docker.yaml from
any branch, which is broader than intended.

- collapse resolve_namespace() to production-only constants
- remove release-namespace action input (no longer needed)
- remove test-main and test-release/** branch triggers
- tighten tag regex to ^v in release-binaries.yaml
- simplify release_docker_image_version_from_tag to vX.Y.Z only
- restore top-level concurrency in release-binaries.yaml
- align actions/checkout pin to v6.0.3 across finalize-release.yaml

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Fix git option injection: add -- before tag/branch args in git tag and
  git push calls (git check-ref-format accepts --force-style names)
- Move inputs.mode out of inline bash interpolation into env var (MODE)
  per GitHub Actions injection guidance
- Move write_outputs to after all git mutations in finalize mode
- Align SHORT_HASH to bash slice in manifest job (was --short=8, which
  can return 9+ chars; build job already used ${SHA::8})
- Add note when Release kind is promoted from patch to minor (PATCH=0)
- Add comments documenting Copybara branch coupling and extract_body_field
  single-line guarantee

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Move inputs.repository-path out of inline bash interpolation into env
  var (REPOSITORY_PATH) to match MODE/PR_BODY/etc pattern
- Use refs/tags/${TAG} in git rev-list to disambiguate tag from branch
  if names collide (unambiguous ref path)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…cker images

The finalize-release job's condition never checked github.event.action,
so relabeling an already-merged sync/* PR (a lower bar than merge rights)
could re-enter the tag/branch creation and binary release chain long
after merge. Add the missing action == 'closed' guard, matching the
validate job's existing check.

Also add a reminder comment on the release PR when finalize succeeds,
since Docker image publishing can't be auto-chained (Cloudsmith OIDC
can't trust a release/* wildcard claim) and was otherwise left as an
easy-to-forget manual step despite docs/installation.md documenting
Docker images as a primary install path.

resolve_namespace(), the TAG_PREFIXES array, and tag_prefixes_for_error()
were vestiges of a dropped test-namespace feature: NAMESPACE was always
"production" and RELEASE_REF_PREFIX always "". Collapse them to plain
constants and drop the now-unused release-config.sh helpers that only
resolve_namespace() called.

Also normalize the Release kind PR-body field (trim + lowercase) since
it can be hand-edited, and exact-match case-sensitivity was an easy
foot-gun.

release-binaries.yaml's version-resolution steps captured the entire
anchored tag regex, so VERSION was always identical to TAG; use TAG
directly instead of the redundant alias. Drop the release job's
job-level concurrency group, which the workflow's top-level
release-binaries-${tag} group already fully serializes.

build-docker.yaml's image_version/release_tag outputs were computed
but never consumed anywhere (no job-level outputs block, nothing reads
them) — drop the dead output writes, keep the tag-format validation
that runs alongside them.

tr -d '[:space:]' removed internal whitespace too, so a typo like
"min or" silently became a valid "minor" instead of failing loudly.
Trim only leading/trailing whitespace, keeping internal-whitespace
typos as hard errors.

…-release.sh

The namespace-collapse refactor removed the last two functions
finalize-release.sh called from release-config.sh, leaving the
source (and the SCRIPT_DIR/REPO_ROOT plumbing that located it) dead.
release-config.sh is still sourced where it's actually used, in
build-docker.yaml.