[MLittleprince]

Summary

• trigger the cloud-plugin release workflow after a same-repository PR is merged into main and all four committed version files increase consistently
• derive stable/prerelease npm channels automatically, publish and verify npm, then create an immutable tag and a human-reviewed Draft Release
• keep stable Docs synchronization behind the manual Publish release boundary; prereleases remain excluded from formal Docs synchronization
• add fail-closed version gates, immutable-source checks, bounded npm/GitHub propagation verification, idempotent reruns, and explicit metadata recovery
• support optional reviewed .github/release-notes/v<version>.md files while retaining the 106 evidence-backed draft path
• document the release-owner workflow and remove any need for Actions to create version-update PRs

Release behavior

• ordinary merges with unchanged versions are skipped
• partial, inconsistent, downgraded, or ambiguous version transitions fail closed
• stable versions use npm latest and create a normal Draft Release
• beta/alpha/other prereleases use beta/alpha/next and create a Prerelease Draft
• npm version, gitHead, and dist-tag are verified before tag/Draft creation
• a rerun after npm success verifies the original merge commit and only completes missing tag/Release metadata

Validation

• release-script tests: 76 passed
• plugin tests: 139 passed
• actionlint: passed
• npm pack dry-run: passed (17 files)
• git diff --check: passed
• historical replay: PR 0.1.20 #152 detected as 0.1.20-beta.0, PR 0.1.20 #155 as stable 0.1.20, PR ci: harden npm release propagation verification #156 correctly skipped as version-unchanged

Review notes

This PR does not change any of the four package version values, so merging this PR must not publish npm or create a release. The first real end-to-end automatic publish will occur only when a later reviewed PR consistently increases all four version files.

The repository does not need to enable Allow GitHub Actions to create and approve pull requests. Actions consume the reviewed main commit and never create a version-writeback PR.