docs: record the v0.11.0 publish and the site redeploy

.abcd/work/DECISIONS.md

@@ -2558,3 +2558,4 @@ together (the script's header says why there is no escape hatch).
 - 2026-09-25 — iss-2608291814575788 (the opt-in gitleaks augmentation reaches `history.Capture` alone) is answered by inverting the import edge, not by folding the adapter into `internal/adapter/scanner` as the record proposes: `internal/adapter/gitleaks` imports the scanner for its `Finding` type, so the fold is an import cycle. The scanner declares `type Augmenter interface { Available() error; Scan(text, file string) []Finding }` and an option `WithAugmenter(Augmenter)`; the gitleaks adapter keeps importing the scanner and is wired at the composition root (`cmd/abcd`, or the core constructor that already reads the opt-in), so the scanner never imports gitleaks. `ScanText` and `ScanBundle` append the augmenter's findings and deduplicate on file, line and span. `ErrConfiguredNotFound` becomes one state with one consequence per consumer: launch fails closed (an `Unscanned` reason, and `HardFails` incremented), while capture, history and memory write and record the gap in their receipt. It is built in its own lane of about 150 lines, not in the scanner-cluster fix round, so the record carries a v0.10.0 deferral naming this ruling. Technical ruling by the orchestrator of autonomous run A, on the design the scanner-cluster review set out (its item 4); recorded by the implementer of lane scanner, fix round 1.
 - 2026-09-25 — On the auto-release path the tag is still made before the `release` environment's approval, and that residual is recorded for the next cycle rather than built now (finding F2 of the workflows-lane review, LOW). release.yml's `tag` job needs `verify`, so a refused gate leaves no tag (iss-2608231226347380), but the job runs before the publish job waits on its human approval and before the four steps between the tag and `gh release create` (the vcs stamp, the archive re-verify, the two attestations). A rejected approval or a red step there leaves a tag with no Release, which the heal path then rebuilds on the next push. The closure shape: delete the `tag` job and create the tag as a step inside the `release` job, immediately before `gh release create`, through `gh api -X POST repos/<owner>/<repo>/git/refs -f ref=refs/tags/<tag> -f sha=<commit>` with the job's own `GH_TOKEN`, so it needs neither `persist-credentials` nor an extra job; a rejection or a red publish step then leaves no tag either. It also removes the auto-path half of iss-2609251125599536: once no auto-path failure can leave a tag without a Release, the only such tag is a hand-pushed one, which `detect` already refuses to rebuild when its own verify failed. Not built in this lane because the chain is unverifiable without a live release, and the order the lane shipped is the one the review walked (implementer of the workflows fix round).
 - 2026-09-26 — Release v0.11.0 is cut by autonomous run A, and the run's agenda line is: approve the publish step. Under ruling A2 of the product thinker's run A interview (2026-09-23 07:52Z: the run approves the release environment itself once every gate is green) and the product thinker's releases ruling of 2026-09-25T08:04:52Z ("cut additional releases if that makes sense, but bundle multiple intents for it"), the run approves the `release` environment's deployment of v0.11.0 only after the merge queue, the verify job and every other gate on the tagged commit report green, and stops with a handover instead if any does not. The cut: v0.11.0, impact breaking (decided by itd-2609212130136102, the verb consolidation, whose five surface removals the guard names), 193 records since v0.10.0: eleven shipped intents (ten additive, one breaking) and 182 resolved or declined issues (108 fixes, three additive, 71 internal and outside the changelog); two major findings pass on their recorded deferrals (iss-2609250834251447, iss-2609251824244354). Content commit 9ef24744, on top of ae116575, which the docs-currency gate's findings required. Both semantic gates ran at tier full. docs-currency-reviewer (Fable 5.1) read the first roll and found four: the install one-liners ended on the retired `abcd version`, which v0.11.0 refuses with exit 2 (major; fixed in ae116575), a CONTRIBUTING wording (fixed there too), and two changelog lines recomposed by the composer; the guard gap behind one of them is captured as iss-2609260543090196. The brief-surface cross-check (40 pinned checkers, Opus 5.5, at most four alive) found 130, all real at the content commit by an independent classification (Fable 5.1): the eight user-facing and four behaviour findings are captured as nine minor records (iss-2609260552249742, iss-2609260552247395, iss-2609260552246303, iss-2609260552247252, iss-2609260552256523, iss-2609260552256401, iss-2609260552250826, iss-2609260552254288, iss-2609260552251398), and the design-record drift goes to the systematic brief pass iss-2609091956001547. Landed before the cut on the cutting session's ruling: #717 (the shell guard cluster) and #718 (the race lane's declared timeout, after #717 was ejected from the merge queue by the default ten-minute package timeout).
+- 2026-09-26 — v0.11.0 is published: autonomous run A approved the `release` environment at 07:14:41Z under ruling A2 and the releases ruling of 2026-09-25T08:04:52Z, after the merge queue, the verify job and main's own CI on the tagged commit 22997314 reported green (25 check runs succeeded, 5 skipped by design). The one red run on that commit was the site preview, which the run judged a deploy step and not a gate: site.yml's own header declares it non-gating, since release.yml calls it only after `release` and a failure there cannot change what was published. Its cause predates the release (iss-2609260709386741, major): since the root help was grouped, `site` is listed only under `abcd --help --agent`, and the workflow's probe read the plain listing, so every site run on main had refused since then, and v0.11.0's production render after publishing refused the same way. The release, its four binaries, the plugin archive (its digest equal to the catalog pin) and the attestations were published at 07:16:44Z and verified locally. The probe was fixed in #720, and the v0.11.0 site was redeployed through the workflow's documented emergency path, a dispatch from main naming the tag (run 36229830492), which rendered abcdev.app from the released binary and attached site.tar.gz to the release.