feat(release): automate the ORB stable-release channel with a standing Release PR

[JSONbored]

Summary

• The ORB (self-host container image) beta channel has been fully automated since feat(selfhost): automate daily ORB beta releases from a version manifest #4160 (daily cron + on-demand, orb-beta-release.yml), but promoting to a stable orb-vX.Y.Z release stayed a fully manual git tag dance with no scheduled cadence -- the one release surface in this repo not already brought up to release-please parity (MCP/engine here via mcp-release-please.yml, plus metagraphed's own release-please.yml).
• Adds a release-please-equivalent for ORB (hand-rolled, not the literal tool): ORB's image-relevant scoping is cross-cutting (src/** shared with UI/MCP-only subtrees it must exclude -- see orb-release-core.mjs's IMAGE_RELEVANT_PREFIXES/EXCLUDED_PREFIXES) rather than a clean directory component the way packages/gittensory-mcp and packages/gittensory-engine are, so release-please's own path-scoped commit scanning doesn't fit cleanly.
• buildOrbStableReleaseReport (scripts/orb-release-core.mjs) infers the next stable version from conventional commits since the last stable orb-v tag, reusing the same image-relevant commit filtering the beta channel already uses.
• orb-stable-release-pr.yml runs on the same 2-day schedule as mcp-release-please.yml (plus workflow_dispatch) and keeps a standing release-orb-stable branch + PR in sync with that proposal (bumps orb-manifest.json, lists the relevant commits) -- nothing ships until a maintainer reviews and merges it, same UX contract as every other package's release automation in this org.
• orb-stable-release-tag.yml fires on that PR's merge (a genuine human GitHub-UI action, not a bot-authored push, so none of the GITHUB_TOKEN recursion-prevention caveats the other release workflows document apply here), tags orb-vX.Y.Z, and dispatches release-selfhost.yml exactly like the beta workflow does -- landing on the human-gated release environment (not release-beta) since the version has no -beta. suffix, so promoting to stable still gets a second, independent reviewer approval beyond the PR merge itself.
• The daily, fully-unattended beta channel is unchanged.

Maintainer PR (JSONbored) -- no linked issue per the repo's maintainer exception.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• Maintainer PR -- no linked issue required.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally -- new pure logic (buildOrbStableReleaseReport, exported inferReleaseType, the new commitsSinceStable report field) is 100% covered by new/extended tests in test/unit/orb-release.test.ts; scripts/** is outside Codecov's src/** patch-coverage scope regardless.
• npm run test:workers (via npm run test:ci)
• npm run build:mcp (via npm run test:ci)
• npm run test:mcp-pack (via npm run test:ci)
• npm run ui:openapi:check (via npm run test:ci) -- no API/schema changes.
• npm run ui:lint (via npm run test:ci)
• npm run ui:typecheck (via npm run test:ci)
• npm run ui:build (via npm run test:ci)
• npm audit --audit-level=moderate -- 0 vulnerabilities.
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries -- see test/unit/orb-release.test.ts additions (patch/minor/major inference, no-commits/UI-only-excluded not-due paths, zero-stable-tags baseline, omitted-commitsSinceStable default).

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A -- release infra only, no runtime auth surface touched.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (N/A.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (N/A -- no UI changes.)
• Visible UI changes include a UI Evidence section. (N/A -- no UI changes.)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. (N/A.)

Notes

• Backend/CI-infra-only change; no UI Evidence section is included.
• Once merged, the first scheduled orb-stable-release-pr run (or an on-demand workflow_dispatch) will open the initial release-orb-stable PR proposing orb-v0.4.0 from the current orb-v0.3.0 baseline.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.13%. Comparing base (3832ee3) to head (89067fc).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5063   +/-   ##
=======================================
  Coverage   94.13%   94.13%           
=======================================
  Files         465      465           
  Lines       39554    39554           
  Branches    14433    14433           
=======================================
  Hits        37235    37235           
  Misses       1664     1664           
  Partials      655      655           

Flag	Coverage Δ
shard-1	46.50% <ø> (ø)
shard-2	33.56% <ø> (ø)
shard-3	31.33% <ø> (ø)
shard-4	32.68% <ø> (ø)
shard-5	33.43% <ø> (ø)
shard-6	44.94% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.