plan: fix release tap policy/workflow mismatch

.ergo/plans.jsonl

@@ -3501,3 +3501,4 @@
 {"type":"result","ts":"2026-02-25T22:52:33.245514Z","data":{"task_id":"UMCU3R","summary":"Backfill actionable hints for hint-less Internal CLI errors","path":"src/main.rs","sha256_at_attach":"8eb075b555bf21e1c89fb32769c372444b039e6c1fd07ff0fdfb178e4620959d","mtime_at_attach":"2026-02-25T22:50:43.149382621Z","git_commit_at_attach":"3f34847dfa4e12c81c1885e43768df676f559830","ts":"2026-02-25T22:52:33.245514Z"}}
 {"type":"body","ts":"2026-02-25T22:52:33.275686Z","data":{"id":"UMCU3R","body":"## Evidence\n- `src/command_dispatch.rs:117-123` constructs `ErrorKind::Internal` for runtime startup failure without `.with_hint(...)`.\n- `src/main.rs:125-127` only auto-applies hint enrichers for Corrupt/Io/Permission/Busy (`add_corrupt_hint` + `add_io_hint`).\n- `src/main.rs:2327-2362` renders a hint only if one already exists on the error.\n\n## Violated property\n- `docs/record/vision.md` operational clarity expectation (CLI errors should provide actionable remediation guidance).\n\n## Suggested fix\n- Add a final CLI-side hint enrichment pass for `ErrorKind::Internal` (and any remaining no-hint public kinds), or require all public constructors to supply a hint/doc reference.\n- Keep existing explicit hints as highest-priority and only backfill when missing.\n\n\n\n## Completion Note\n- Added a final CLI error enrichment pass (`add_internal_hint`) in `src/main.rs` run pipeline.\n- Internal errors without explicit hints now receive actionable remediation guidance while preserving existing explicit hints as higher priority.\n- This ensures JSON and human stderr surfaces consistently include hints for previously uncovered internal failure paths.\n","ts":"2026-02-25T22:52:33.275686Z"}}
 {"type":"state","ts":"2026-02-25T22:52:33.275686Z","data":{"id":"UMCU3R","state":"done","ts":"2026-02-25T22:52:33.275686Z"}}
+{"type":"new_task","ts":"2026-02-26T19:16:20.855254Z","data":{"id":"H6TXUZ","uuid":"2ffa1be4-5e53-49cf-8f0a-4832086ac6bc","epic_id":"","state":"todo","title":"release: align tap policy and release-publish workflow","body":"## Goal\n- Make the Homebrew tap flow consistent end-to-end: maintainer updates and pushes `../homebrew-tap` locally, while CI only verifies alignment.\n- Remove CI behavior that mutates the tap repository during `release-publish` live runs.\n\n## Background/Rationale\n- Docs and skill guidance now require local tap updates, but `.github/workflows/release-publish.yml` still includes a token-gated commit/push path.\n- This split-brain process creates release risk (double-writes, token dependency drift, and unclear source of truth).\n\n## Acceptance Criteria\n- `release-publish.yml` no longer commits or pushes Formula changes to the tap repo in any mode.\n- `sync-homebrew-tap` verifies checksum/version alignment against remote tap state for live runs and local checkout for rehearsal runs, without mutating tap history.\n- Workflow comments, job naming, and docs-of-record references describe the same responsibility split (local update + CI verification).\n- Secrets policy is coherent: workflow no longer requires a live tap push token path for this job.\n\n## Validation Gates\n- `rg -n \"Commit and push tap update|HOMEBREW_TAP_TOKEN is required|git -C homebrew-tap push\" .github/workflows/release-publish.yml` returns no matches.\n- `rg -n \"Homebrew tap is updated locally|sync-homebrew-tap\" docs/record/releasing.md skills/plasmite-release-manager/SKILL.md .github/workflows/release-publish.yml` shows consistent wording.\n- `just ci-fast`\n\n## Consult Me\n- If removing CI push support would break an expected emergency fallback, pause and ask whether to keep a separate manual-only workflow for tap sync.\n","created_at":"2026-02-26T19:16:20.855254Z"}}