ci: make release promotion tag-driven and keep audits informational

docs/CICD_MULTI_STAGE_BUILD.md

@@ -171,16 +171,19 @@ jobs:
   promote-release-images:
     needs: [build_cicd, build-release-images, integration-tests, e2e-tests]
     # retags staging images to deployable-backend/deployable-frontend with:
-    # - release version tag (semver)
-    # - release build tag (<semver>-<7-char-short-sha>)
+    # - release series tag (<major>.<minor>.0)
+    # - exact git semver tag from HEAD (authoritative release tag)
+    # - release build tag (<git-semver>-<7-char-short-sha>)
     # - latest
 ```
 
 ### Release Tagging Model
 
-- If the current commit has a semver git tag (`v<major>.<minor>.<patch>`), promotion uses that exact version.
-- Otherwise, promotion finds the latest semver baseline and auto-increments patch for the next successful release in that major/minor line.
-- Each promoted release also publishes a build-distinguishing tag: `<semver>-<short_sha>`, where `<short_sha>` is the 7-character commit shorthand.
+- Promotion is release-tag driven: if HEAD has no semver git tag (`v<major>.<minor>.<patch>`), promotion is skipped.
+- Release identity is derived from the git tag on HEAD.
+- Release series tag is normalized to `<major>.<minor>.0`.
+- Each promoted release also publishes a build-distinguishing tag: `<git-semver>-<short_sha>`, where `<short_sha>` is the 7-character commit shorthand.
+- Promotion emits generated release notes summarizing commit subjects since the previous `<major>.<minor>.0` release tag.
 
 ### Responsibility Split
 

docs/DEVELOPMENT.md

@@ -415,7 +415,7 @@ The pipeline is intentionally staged so expensive image jobs run only after sour
 4. Runtime validation lanes:
    `Runtime Black-Box Integration Tests` and `End-to-End Tests` validate staged runtime artifacts.
 5. Promotion lane:
-   `Promote Release Images` retags validated staging artifacts to release repos (`deployable-backend`, `deployable-frontend`) with `latest`, `<semver>`, and `<semver>-<7-char-short-sha>` tags.
+   `Promote Release Images` runs only when HEAD has a semver git tag and retags validated staging artifacts to release repos (`deployable-backend`, `deployable-frontend`) with `latest`, `<major>.<minor>.0`, `<tagged-semver>`, and `<tagged-semver>-<7-char-short-sha>` tags.
 6. Postmortem lanes:
    targeted postmortem jobs run when key lanes fail to capture diagnostics even when primary jobs fail early.
 
@@ -426,6 +426,7 @@ Current workflow behavior includes:
 - registry auth realm host pinning from `WWW-Authenticate` challenge when registry tokens are issued from a different host
 - bounded retry logic for docker login/pull/push operations in image lanes
 - digest/tag contract checks for deployable image references before runtime black-box tests
+- release-note summary generation in the promotion lane (commit bullets since previous `<major>.<minor>.0` release tag)
 - context hydration for image-build lanes by copying `/workspace` from the published CICD image
 - runner split between `ubuntu-act` and `ubuntu-act-8gb` based on lane resource requirements