What changed

No user-facing behavior change. Moves the release flow from a local release.sh script to a GitHub Actions Release prepare workflow. Releases are now cut via gh workflow run release-prepare.yml ... (or the GH Actions UI), with a dry_run=true mode for plan-only previews.

Technical Context

• tools/release/bump.sh is the new source of truth for parsing, validating, and rewriting version.properties and VERSION. Mirrors the versionCode formula in ProjectConfig.kt. 32 bats tests cover bumps, bounds, drift, monotonicity, and write post-conditions.
• Two-job split in release-prepare.yml: compute-and-validate (no environment) writes the planned version to the run summary, then push-and-dispatch (foss-production environment approval) commits, tags, atomically pushes, and dispatches release-tag.yml. Reviewer sees the plan before approving.
• Atomic push (git push --atomic origin HEAD:refs/heads/main refs/tags/v<new>) so a failed half can't leave main ahead of the tag.
• Explicit gh workflow run release-tag.yml after the push — GITHUB_TOKEN pushes don't trigger downstream on: push workflows. Auth precheck in Job 1 fails fast if dispatch would fail later.
• release-tag.yml gains a validate-tag job (regex on github.ref_name, bump.sh --mode=check, tag/version match) plus concurrency on the tag ref. Manual gh workflow run release-tag.yml --ref vfoo or hand-pushed v* tags now fail before any build.
• Job 2 passes --expected-current to bump.sh so a moving main during the approval wait fails fast.
• Numeric fields bounded 0..99 (the versionCode formula major*10M + minor*100K + patch*1K + build*10 collapses at ≥100).
• Fastlane channel mapping documented in .claude/rules/release.md — rc tag → lane :production → Play beta track at 10% rollout (manual promotion to production via Play Console). Reflects current Fastfile behavior, not changed.
• Out of scope: per-version Play Store changelogs (length-limited, would diverge from GitHub notes).

Review checklist

• Skim release-prepare.yml — two jobs, foss-production env approval on Job 2
• Skim the validate-tag addition in release-tag.yml
• Run bats tools/release/bump.bats locally (32 tests, ~1s)
• After merge: dispatch release-prepare.yml with dry_run=true to verify the pipeline before cutting a real release