- align dev-release workflow with protected-branch bypass used by release.yml - add a workflow regression test so checkout and release auth do not drift back to github.token