feat(ci): add staged release pipeline workflows (dormant)

Add all new CI/CD workflow files for the staged branch promotion pipeline
(develop  alpha  beta  main). Push triggers are intentionally disabled
workflows use workflow_dispatch or workflow_call only.

No changes to existing ci.yml. All workflows are inert until activated in
a follow-up PR.

New workflows:
- feature-pr.yml: auto-create PRs to develop (disabled)
- hotfix-pr.yml: emergency hotfix PRs to main (disabled)
- promote-branch.yml: staged promotion (disabled)
- release-orchestrator.yml: release pipeline (disabled)
- deployment-strategy.yml: npm + Docker deploy (workflow_call)
- testing-strategy.yml: progressive test gates (workflow_call)
- generate-changelog.yml: changelog generation (workflow_call)
- version-operations.yml: version bumping (workflow_call)
- release.yml: manual release trigger (workflow_dispatch)
- rollback.yml: emergency rollback (workflow_dispatch)
- discord-notify action: reusable notification

Also adds pipeline docs and updates CONTRIBUTING.md with future branch
strategy (clearly marked as not yet active).

Split from #10755 for safe, additive merge.

.github/workflows/ci.yml

@@ -1,18 +1,12 @@
 name: CI
 
 on:
+  push:
+    branches: [main]
   pull_request:
-  workflow_call:
-    # Called by testing-strategy.yml for staged releases
-    inputs:
-      test_stage:
-        description: "Testing stage: develop, alpha, beta, or stable. Controls which platform tests run."
-        required: false
-        type: string
-        default: ""
 
 concurrency:
-  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  group: ci-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
 jobs:
@@ -193,10 +187,6 @@ jobs:
           fi
 
   checks-windows:
-    # Windows tests: beta+ staging only (not on regular PRs to save compute)
-    if: |
-      inputs.test_stage == 'beta' ||
-      inputs.test_stage == 'stable'
     runs-on: blacksmith-4vcpu-windows-2025
     env:
       NODE_OPTIONS: --max-old-space-size=4096
@@ -305,9 +295,12 @@ jobs:
       - name: Run ${{ matrix.task }} (${{ matrix.runtime }})
         run: ${{ matrix.command }}
 
-  checks-macos:
-    # macOS tests: stable staging only (not on regular PRs to save compute)
-    if: inputs.test_stage == 'stable'
+  # Consolidated macOS job: runs TS tests + Swift lint/build/test sequentially
+  # on a single runner. GitHub limits macOS concurrent jobs to 5 per org;
+  # running 4 separate jobs per PR (as before) starved the queue. One job
+  # per PR allows 5 PRs to run macOS checks simultaneously.
+  macos:
+    if: github.event_name == 'pull_request'
     runs-on: macos-latest
     steps:
       - name: Checkout

.github/workflows/feature-pr.yml

@@ -3,12 +3,15 @@ name: Feature PR
 # Auto-create PR from dev/* branches to develop
 # This is the entry point for new features into the staging pipeline
 
+# NOTE: push triggers disabled until staging pipeline is activated.
+# To enable: uncomment the push block and remove workflow_dispatch.
+#   push:
+#     branches:
+#       - "dev/**"
+#       - "feature/**"
+#       - "fix/**"
 on:
-  push:
-    branches:
-      - "dev/**"
-      - "feature/**"
-      - "fix/**"
+  workflow_dispatch:
 
 concurrency:
   group: feature-pr-${{ github.ref_name }}

.github/workflows/hotfix-pr.yml

@@ -5,10 +5,13 @@ name: Hotfix PR
 #
 # Flow: hotfix/* → main (directly, with expedited review)
 
+# NOTE: push triggers disabled until staging pipeline is activated.
+# To enable: uncomment the push block and remove workflow_dispatch.
+#   push:
+#     branches:
+#       - "hotfix/**"
 on:
-  push:
-    branches:
-      - "hotfix/**"
+  workflow_dispatch:
 
 concurrency:
   group: hotfix-${{ github.ref_name }}

.github/workflows/promote-branch.yml

@@ -11,15 +11,17 @@ name: Promote Branch
 #
 # Merging to main triggers a release (handled separately by release workflow)
 
+# NOTE: push triggers disabled until staging pipeline is activated.
+# To enable: uncomment the push block below.
+#   push:
+#     branches:
+#       - develop
+#       - alpha
+#       - beta
+#     paths-ignore:
+#       - "docs/**"
+#       - "*.md"
 on:
-  push:
-    branches:
-      - develop
-      - alpha
-      - beta
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
   workflow_dispatch:
     inputs:
       source_branch:

.github/workflows/release-orchestrator.yml

@@ -7,15 +7,16 @@ name: Release Orchestrator
 #
 # Flow: version → changelog → test → deploy → release
 
+# NOTE: push-to-main trigger disabled until staging pipeline is activated.
+# To enable: uncomment the push block below.
+#   push:
+#     branches:
+#       - main
+#     paths-ignore:
+#       - "docs/**"
+#       - "*.md"
+#       - ".github/workflows/docs-*.yml"
 on:
-  push:
-    branches:
-      - main
-    paths-ignore:
-      - "docs/**"
-      - "*.md"
-      - ".github/workflows/docs-*.yml"
-
   workflow_call:
     inputs:
       release_type:

CONTRIBUTING.md

@@ -97,13 +97,17 @@ Skills submitted as PRs to this repo will be redirected to ClawHub. If the core
 
 ## Branch Strategy
 
-We use staged branch promotion to keep `main` stable:
+> **Note:** The staged promotion pipeline is not yet active. Workflows are in
+> place but dormant. For now, open PRs targeting `main` as usual. Once the
+> pipeline is activated, the flow below will apply.
+
+We will use staged branch promotion to keep `main` stable:
 
 ```
 dev/* / feature/* / fix/*  →  develop  →  alpha  →  beta  →  main
 ```
 
-### For External Contributors
+### For External Contributors (once pipeline is active)
 
 1. Fork the repo
 2. Create your branch (`dev/my-feature`, `fix/some-bug`, etc.)
@@ -111,9 +115,7 @@ dev/* / feature/* / fix/*  →  develop  →  alpha  →  beta  →  main
 4. CI runs lightweight checks only — no heavy platform tests on your PR
 5. Once merged to `develop`, your changes promote through alpha → beta → main automatically
 
-**Do not target `main`** — PRs to `main` will be redirected to `develop`.
-
-### For Maintainers
+### For Maintainers (once pipeline is active)
 
 - **Regular changes**: merge to `develop`, let the pipeline promote
 - **Hotfixes**: use `hotfix/*` branches for emergency fixes that bypass staging directly to `main`