test(release): prevent duplicate stable release runs

[t3-code]

What Changed

• add a regression test requiring both GitHub Release steps to use the repository-scoped workflow token
• document why release publication must stay on that token while stable releases are manually dispatched

Why

Stable releases from v0.0.26 through v0.0.31 published twice because the first run created its tag with the Release App token, which started a second tag-triggered workflow that appended the generated notes again. #5394 already moved publication to GITHUB_TOKEN, whose generated tags do not trigger new workflow runs. This locks in that fix while preserving legitimate direct tag reruns.

Verification

• vp test run scripts/release-workflow.test.ts
• vp run --filter @t3tools/scripts typecheck
• vp fmt --check scripts/release-workflow.test.ts docs/operations/release.md
• git diff --check

Checklist

• This PR is small and focused
• I explained what changed and why
• Before/after screenshots are not applicable
• Animation/interaction video is not applicable

Generated by GPT-5.6-sol using the Codex harness in T3 Code.

---

Note

Low Risk
Test and documentation only; no runtime or workflow behavior changes.

Overview
Adds a regression test that parses .github/workflows/release.yml and asserts both softprops/action-gh-release steps in the release job publish with token: ${{ github.token }}.

Docs in docs/operations/release.md now explain that workflow-token tags do not start a second run (avoiding double publication on manually dispatched stable releases) and that publication should stay on that token unless tag-trigger strategy changes.

^{Reviewed by Cursor Bugbot for commit 0ecf404. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add test to enforce github.token usage in release workflow publish steps

• Adds a test in release-workflow.test.ts that parses .github/workflows/release.yml and asserts both softprops/action-gh-release steps use ${{ github.token }}, preventing accidental use of a PAT that would trigger a duplicate stable release run.
• Updates release.md to document why the workflow token must be kept for tag creation steps.

^{Macroscope summarized 0ecf404.}

[macroscopeapp]

Approvability

Verdict: Approved 0ecf404

Documentation-only change to release.md plus a new test file verifying release workflow token configuration. No runtime code or behavior is affected.

^{You can customize Macroscope's approvability policy. Learn more.}

[t3-code]

closing since #5394 already contains the fix and we don't need the extra policy test.