branching: release now carries the required check (#168)

.claude/BRANCHING.md

@@ -82,15 +82,19 @@ correct" rather than erroring.
 3. **Protection.** `forge_branch_protection(branch="dev", apply=true)`, then
    `main`, then `release`.
 
-   `dev` and `main` get the required check; **`release` does not**, and that is
+   **All three** branches get the required check. `release` was the exception
-   deliberate. `pr-build.yml` fires only for PRs into `dev` and `main`, so a PR
+   until 2026-08-01: `pr-build.yml` fired only for PRs into `dev` and `main`, so
-   into `release` reports no status at all — requiring a context nothing
+   a PR into `release` reported no status at all, and requiring a context
-   produces would make every production promotion permanently unmergeable, with
+   nothing produces makes every production promotion permanently unmergeable —
    a 405 that names no cause. This estate has already lost an afternoon to
-   exactly that, from a single mistyped check name. If you want it closed
+   exactly that, from a single mistyped check name.
-   properly, do it in this order: add `release` to `pr-build.yml`'s
+
-   `on.pull_request.branches`, confirm on a real PR that the context appears,
+   It was closed in the only safe order, and that order still governs any change
-   *then* pass `require_checks_on_release: true`. The other order blocks prod.
+   to the context name, or a new protected branch: add the branch to
+   `pr-build.yml`'s `on.pull_request.branches`, confirm **on a real PR** that
+   the context appears, *then* require it. Confirmed on #167 — the gate reported
+   `PR build (required check) / gate (pull_request)` — before the check was
+   enabled. The other order blocks prod.
 4. **Stale branches.** `forge_branches()` lists every branch with its age, how
    much unmerged work it carries, and a verdict:
    - `merged` — nothing on it the trunk lacks. Delete freely.