feat: add documentation for release notes verification and workflow testing

.claude/agent-memory/critic/risk_release_workflow_untestable.md

@@ -0,0 +1,15 @@
+---
+name: risk-release-workflow-untestable-pre-tag
+description: .gitea/workflows/release.yml only runs on a v*.*.* tag that also publishes live to the Chrome Web Store — review it by extracting and executing the embedded script locally.
+metadata:
+  type: project
+---
+
+`.gitea/workflows/release.yml` and `.gitea/workflows/deploy-chrome.yml` both trigger only on `push: tags: v*.*.*`, and the deploy workflow publishes live to the Chrome Web Store. A bug in either is first observed during a real release.
+
+**Why:** there is no dry-run path; CI never exercises these files on a normal push.
+
+**How to apply:** when a release workflow embeds a script in a heredoc inside a YAML block scalar, extract it and run it rather than reading it. Working recipe used on 2026-08-12:
+`sed -n '<first>,<last>p' .gitea/workflows/release.yml | sed 's/^          //' > <scratchpad>/brp.js` then run it with the relevant env var set, over the real `CHANGELOG.md`, for: the current tag, an older tag, the oldest tag (last-section / no-next-heading case), a tag with no section (fallback), and a prefix-collision tag such as `v1.1.0-beta`. This confirmed indentation stripping, heredoc termination, `VERSION="$VERSION" node ...` env passing, and JSON safety of `→`/em-dash/backticks in one pass.
+
+Also compare any zip/packaging edit against the known-good pattern at `.gitea/workflows/deploy-chrome.yml:47-57` — that pattern was itself a fix (commit `1fedaf4`) for a nested-directory zip that Chrome rejected. Related: [[risk-release-notes-unverified-claims]].