refactor(release): drop release-policy.json runtime dep and next branch

Strips the release-policy.json fallback from release-version.ts so the CLI
reads its version straight from packages/cli/package.json. dev → 0.0.0-private,
installed @kaelio/ktx → the real semver baked into the published package.json.
KtxCliPackageInfo collapses to { name, version, contextPackageName }; /health
no longer depends on version files surviving past a CI run.

Replaces the dual-branch (main + next) semantic-release model with a single-
branch model on main. rcs and stables interleave on the same branch via
{ name: 'main', prerelease: 'rc', channel: 'next' } / ['main']. Drops
@semantic-release/git and @semantic-release/changelog (nothing is committed
back to the repo on any channel) and the workflow's "Prepare next prerelease
branch" step plus the KTX_PRERELEASE_BRANCH plumbing. The git tag plus the
published npm artifact carry the version forward.

Updates docs/release.md, removes the two now-unused devDeps, regenerates
pnpm-lock.yaml. 611/611 @ktx/cli tests, 173/173 script tests, type-check,
biome, knip all clean.

scripts/release-workflow.test.mjs

@@ -21,15 +21,14 @@ describe('release workflow', () => {
     assert.doesNotMatch(workflow, /Prepare first stable release floor/);
     assert.doesNotMatch(workflow, /git tag v0\.0\.0/);
     assert.doesNotMatch(workflow, /KTX_STABLE_RELEASE_FLOOR_TAG/);
-    assert.match(workflow, /Prepare next prerelease branch/);
-    assert.match(workflow, /git checkout -B "\$\{KTX_PRERELEASE_BRANCH\}"/);
+    assert.doesNotMatch(workflow, /Prepare next prerelease branch/);
+    assert.doesNotMatch(workflow, /KTX_PRERELEASE_BRANCH/);
+    assert.doesNotMatch(workflow, /GITHUB_REF="refs\/heads\//);
     assert.match(workflow, /Prepare npm package root for release verification/);
     assert.match(workflow, /dist\/public-npm-package\/package\.json/);
-    assert.match(workflow, /GITHUB_REF="refs\/heads\/\$\{KTX_PRERELEASE_BRANCH\}"/);
     assert.match(workflow, /pnpm run semantic-release:dry-run/);
     assert.match(workflow, /pnpm run semantic-release$/m);
     assert.match(workflow, /KTX_RELEASE_KIND: \$\{\{ inputs.release_kind \}\}/);
-    assert.match(workflow, /KTX_PRERELEASE_BRANCH: next/);
     assert.match(workflow, /FORCE_RELEASE: \$\{\{ inputs.force_release \}\}/);
     assert.doesNotMatch(workflow, /NODE_AUTH_TOKEN/);
     assert.doesNotMatch(workflow, /^  push:/m);

scripts/semantic-release-config.cjs

@@ -82,46 +82,23 @@ function releaseKind(env) {
   return env.KTX_RELEASE_KIND || env.INPUT_RELEASE_KIND || 'rc';
 }
 
-function prereleaseBranch(env) {
-  return env.KTX_PRERELEASE_BRANCH || env.INPUT_PRERELEASE_BRANCH || 'next';
-}
-
 function releaseTag(kind) {
   return kind === 'rc' ? 'next' : 'latest';
 }
 
-function releaseChangelogPlugins(kind) {
-  return kind === 'rc' ? ['@semantic-release/changelog'] : [];
-}
-
-function releaseGitPlugins(kind) {
-  if (kind !== 'rc') {
-    return [];
-  }
-
-  return [
-    [
-      '@semantic-release/git',
-      {
-        assets: ['CHANGELOG.md', 'package.json', 'release-policy.json'],
-        message: 'chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}',
-      },
-    ],
-  ];
-}
-
 function releaseBranches(env = process.env) {
   const branch = currentBranch(env);
   const kind = releaseKind(env);
 
+  if (branch !== 'main') {
+    throw new Error(`KTX releases must run from main, got ${branch}`);
+  }
+
   if (kind === 'rc') {
-    return ['main', { name: prereleaseBranch(env), prerelease: 'rc', channel: 'next' }];
+    return [{ name: 'main', prerelease: 'rc', channel: 'next' }];
   }
 
   if (kind === 'stable') {
-    if (branch !== 'main') {
-      throw new Error(`Stable KTX releases must run from main, got ${branch}`);
-    }
     return ['main'];
   }
 
@@ -157,7 +134,6 @@ function createReleaseConfig(env = process.env) {
           },
         },
       ],
-      ...releaseChangelogPlugins(kind),
       [
         '@semantic-release/exec',
         {
@@ -172,7 +148,6 @@ function createReleaseConfig(env = process.env) {
           ].join(' && '),
         },
       ],
-      ...releaseGitPlugins(kind),
       [
         '@semantic-release/github',
         {
@@ -188,7 +163,6 @@ function createReleaseConfig(env = process.env) {
 
 module.exports = {
   createReleaseConfig,
-  prereleaseBranch,
   releaseBranches,
   releaseKind,
   releaseTag,

scripts/semantic-release-config.test.mjs

@@ -9,21 +9,16 @@ function releaseExecOptions(config) {
   return config.plugins.find((plugin) => Array.isArray(plugin) && plugin[0] === '@semantic-release/exec' && plugin[1].prepareCmd)[1];
 }
 
-function releaseExecIndex(config) {
-  return config.plugins.findIndex((plugin) => Array.isArray(plugin) && plugin[0] === '@semantic-release/exec' && plugin[1].prepareCmd);
-}
-
 function pluginNames(config) {
   return config.plugins.map((plugin) => (Array.isArray(plugin) ? plugin[0] : plugin));
 }
 
 describe('semantic-release config', () => {
-  it('configures rc releases on a dedicated next prerelease branch', () => {
+  it('configures rc releases as a prerelease on main', () => {
     assert.equal(releaseKind({ KTX_RELEASE_KIND: 'rc' }), 'rc');
     assert.equal(releaseTag('rc'), 'next');
     assert.deepEqual(releaseBranches({ KTX_RELEASE_KIND: 'rc', GITHUB_REF_NAME: 'main' }), [
-      'main',
-      { name: 'next', prerelease: 'rc', channel: 'next' },
+      { name: 'main', prerelease: 'rc', channel: 'next' },
     ]);
 
     const config = createReleaseConfig({ KTX_RELEASE_KIND: 'rc', GITHUB_REF_NAME: 'main' });
@@ -42,14 +37,6 @@ describe('semantic-release config', () => {
     );
     assert.match(releaseExecOptions(config).publishCmd, /pnpm run release:published-smoke/);
     assert.doesNotMatch(JSON.stringify(config.plugins), /release:npm-publish/);
-    const releaseFilePluginNames = pluginNames(config).filter(
-      (plugin) => plugin === '@semantic-release/changelog' || plugin === '@semantic-release/git',
-    );
-    assert.deepEqual(releaseFilePluginNames, ['@semantic-release/changelog', '@semantic-release/git']);
-
-    const names = pluginNames(config);
-    assert.ok(names.indexOf('@semantic-release/changelog') < releaseExecIndex(config));
-    assert.ok(names.indexOf('@semantic-release/git') > releaseExecIndex(config));
   });
 
   it('configures stable releases only from main with latest tag', () => {
@@ -69,18 +56,21 @@ describe('semantic-release config', () => {
     assert.equal(config.plugins.includes('./scripts/semantic-release-version-policy.cjs'), false);
   });
 
-  it('does not commit release files back to protected main during stable releases', () => {
-    const config = createReleaseConfig({ KTX_RELEASE_KIND: 'stable', GITHUB_REF_NAME: 'main' });
-
-    assert.equal(pluginNames(config).includes('@semantic-release/git'), false);
-    assert.equal(pluginNames(config).includes('@semantic-release/changelog'), false);
+  it('never commits release files back to the repo', () => {
+    for (const kind of ['rc', 'stable']) {
+      const config = createReleaseConfig({ KTX_RELEASE_KIND: kind, GITHUB_REF_NAME: 'main' });
+      assert.equal(pluginNames(config).includes('@semantic-release/git'), false, `${kind}: @semantic-release/git`);
+      assert.equal(pluginNames(config).includes('@semantic-release/changelog'), false, `${kind}: @semantic-release/changelog`);
+    }
   });
 
-  it('rejects stable releases from non-main branches', () => {
-    assert.throws(
-      () => releaseBranches({ KTX_RELEASE_KIND: 'stable', GITHUB_REF_NAME: 'feature/release-test' }),
-      /Stable KTX releases must run from main, got feature\/release-test/,
-    );
+  it('rejects releases from non-main branches', () => {
+    for (const kind of ['rc', 'stable']) {
+      assert.throws(
+        () => releaseBranches({ KTX_RELEASE_KIND: kind, GITHUB_REF_NAME: 'feature/release-test' }),
+        /KTX releases must run from main, got feature\/release-test/,
+      );
+    }
   });
 
   it('keeps the force-release patch escape hatch', () => {