ci(release): run CI + Release on the release branch, never on main

.github/workflows/app-build.yml

@@ -25,7 +25,7 @@ on:
   #   paths:
   #     - "app/**"
   push:
-    branches: [main]
+    branches: [release]
     paths:
       - "app/**"
 

.github/workflows/ci-go.yml

@@ -2,7 +2,7 @@ name: CI-Go
 
 on:
   push:
-    branches: [main]
+    branches: [release]
   pull_request:
 
 jobs:

.github/workflows/release.yml

@@ -1,16 +1,21 @@
 name: Release
 
-# On merge to the default branch (push to main), compute the next semantic
-# version from Conventional-Commit PR titles since the last v* tag, gate on
+# On push to the release branch, compute the next semantic version from
+# Conventional-Commit PR titles since the last v* tag, gate on
 # Go CI, then publish a GitHub release with generated notes, the five
 # cross-compiled Go binaries (issue #204) stamped with that version via
 # -X internal/version.Version (issue #249), and a ledger release record
 # written by the freshly built linux-amd64 binary itself.
 # Version computation is the Go tool scripts/release/nextversion (issue
 # #250): the Go toolchain is the only runtime this workflow needs.
+#
+# main is the integration line and never publishes: cut a release by
+# promoting main onto the release branch —
+#   git checkout release && git merge --ff-only origin/main && git push origin release
+# (or `gh pr create --base release` for a reviewed cut).
 on:
   push:
-    branches: [main]
+    branches: [release]
 
 permissions:
   contents: write
@@ -151,8 +156,8 @@ jobs:
 
   release:
     needs: [semver, go-test, go-windows-cross, go-windows-build, go-lint, build]
-    # Skip release runs themselves (tag pushes) and fork pushes.
-    if: github.ref == 'refs/heads/main' && !startsWith(github.event.head_commit.message, 'Release v')
+    # Release line only: main never publishes. Also skips tag pushes.
+    if: github.ref == 'refs/heads/release' && !startsWith(github.event.head_commit.message, 'Release v')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

README.md

@@ -6,7 +6,7 @@
 
 **The Autonomous Backend Delivery Agent — ticket in, tested pull request out.**
 
-[![CI (Go)](https://github.com/FreePeak/devagent/actions/workflows/ci-go.yml/badge.svg?branch=main)](https://github.com/FreePeak/devagent/actions/workflows/ci-go.yml)
+[![CI (Go)](https://github.com/FreePeak/devagent/actions/workflows/ci-go.yml/badge.svg?branch=release)](https://github.com/FreePeak/devagent/actions/workflows/ci-go.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-6366F1.svg)](LICENSE)
 [![Go](https://img.shields.io/badge/go-1.25-00ADD8)](go.mod)
 [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](CONTRIBUTING.md)
@@ -199,8 +199,9 @@ Research sources backing the PRD are cited inline and collected in the [research
 
 ## Status
 
-Releases are tagged automatically on every push to `main` (see
-[Releases](https://github.com/FreePeak/devagent/releases)); each release
+Releases are tagged automatically on every push to the `release` branch (cut
+by promoting `main` onto it); see
+[Releases](https://github.com/FreePeak/devagent/releases). Each release
 appends a `release-created` row to the orchestration ledger. Current surface:
 
 - **Trackers & hosts** — Linear, Jira, GitHub Issues ingestion; GitHub + GitLab PR publishing