feat: add documentation for release notes verification and workflow testing

.claude/agent-memory/critic/MEMORY.md

@@ -0,0 +1,2 @@
+- [Release notes: unverified claims](risk_release_notes_unverified_claims.md) — CHANGELOG prose copied from commit subjects has shipped false counts and false "where it appears" claims.
+- [Release workflow untestable pre-tag](risk_release_workflow_untestable.md) — release.yml/deploy-chrome.yml only run on a v*.*.* tag that publishes live; extract and run embedded scripts to review.

.claude/agent-memory/critic/risk_release_notes_unverified_claims.md

@@ -0,0 +1,16 @@
+---
+name: risk-release-notes-unverified-claims
+description: Release-note/CHANGELOG entries in LexAI have been written from commit messages and feature-list intuition rather than verified against code — check counts and surface claims against source.
+metadata:
+  type: project
+---
+
+CHANGELOG/release-note prose in this repo has shipped factual errors that came from trusting commit subjects instead of the code.
+
+Proven instances (2026-08-12 review of the v1.1.0 release prep):
+- `CHANGELOG.md` 1.0.1 said Prompt Builder was "a new tab in the popup **and Options**", copying commit `acea99d`'s subject. `git show acea99d:entrypoints/options/Options.tsx` has zero prompt-builder references, and current `entrypoints/options/Options.tsx` still has none.
+- `CHANGELOG.md` 1.1.0 said "12 named prompting patterns ... plus Auto" (implying 13). `PROMPT_PATTERNS` in `src/lib/actions.ts` has 12 entries *including* `auto` → 11 named + Auto.
+
+**Why:** release bodies are generated from `CHANGELOG.md` by `.gitea/workflows/release.yml`, so an unverified claim becomes a permanent public artifact on a tag push that also publishes live to the Chrome Web Store.
+
+**How to apply:** when reviewing any CHANGELOG/release-note change, verify every countable and every "where it appears" claim against the source file (grep the array, grep the entrypoint), and check the commit window with `git log <prev-bump>..<bump>` for user-visible features that were omitted. Do not accept a commit subject as evidence for a user-facing claim. Related: [[risk-release-workflow-untestable-pre-tag]].

.claude/agent-memory/critic/risk_release_workflow_untestable.md

@@ -0,0 +1,15 @@
+---
+name: risk-release-workflow-untestable-pre-tag
+description: .gitea/workflows/release.yml only runs on a v*.*.* tag that also publishes live to the Chrome Web Store — review it by extracting and executing the embedded script locally.
+metadata:
+  type: project
+---
+
+`.gitea/workflows/release.yml` and `.gitea/workflows/deploy-chrome.yml` both trigger only on `push: tags: v*.*.*`, and the deploy workflow publishes live to the Chrome Web Store. A bug in either is first observed during a real release.
+
+**Why:** there is no dry-run path; CI never exercises these files on a normal push.
+
+**How to apply:** when a release workflow embeds a script in a heredoc inside a YAML block scalar, extract it and run it rather than reading it. Working recipe used on 2026-08-12:
+`sed -n '<first>,<last>p' .gitea/workflows/release.yml | sed 's/^          //' > <scratchpad>/brp.js` then run it with the relevant env var set, over the real `CHANGELOG.md`, for: the current tag, an older tag, the oldest tag (last-section / no-next-heading case), a tag with no section (fallback), and a prefix-collision tag such as `v1.1.0-beta`. This confirmed indentation stripping, heredoc termination, `VERSION="$VERSION" node ...` env passing, and JSON safety of `→`/em-dash/backticks in one pass.
+
+Also compare any zip/packaging edit against the known-good pattern at `.gitea/workflows/deploy-chrome.yml:47-57` — that pattern was itself a fix (commit `1fedaf4`) for a nested-directory zip that Chrome rejected. Related: [[risk-release-notes-unverified-claims]].