release: recover and simplify 2026.09.02-r2

[soulteary]

Summary

• prepare the immutable 2026.09.02-r2 release after r1 failed annotated-tag preflight
• retain 2026.09.02-r1 as a source-only audit record and document that no image was built
• simplify fresh publication to one GitHub web action: Publish release
• accept protected lightweight and annotated CalVer tags under the same immutable-tag checks
• remove the tag-push trigger so an annotated tag plus a later GitHub Release cannot create duplicate runs
• retain manual dispatch only for explicit recovery/resume
• align Dockerfile, README, release instructions, contributor examples, and release-validation fixtures on r2

Failure analysis

Release run 33542195599 checked out the correct protected main commit, but refs/tags/2026.09.02-r1 points directly to a commit and is therefore a lightweight tag. The previous preflight stopped at:

Release tag 2026.09.02-r1 must be annotated.

The failure occurred before Docker Buildx setup, registry login, upstream verification, or image construction. Both Docker Hub and GHCR return no manifest for 2026.09.02-r1.

New release flow

After this PR merges and main CI succeeds:

1. Open Releases → Draft a new release.
2. Enter 2026.09.02-r2, choose Create new tag, and target current main.
3. Review the generated notes and click Publish release.

The release.published event checks out that tag and starts the image workflow automatically. Protected-ref, exact version, main ancestry, checkout SHA, registry immutability, SBOM/provenance, and Cosign verification remain required.

Checks

• release-trigger policy regression test
• documentation consistency and MU plugin metadata tests
• entrypoint reconciliation, release evidence, and Cosign retry tests
• Bash syntax check for every shell script
• actionlint v1.7.12
• git diff --check

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T18:19:00.776782Z	b04ce3e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.