docs(release): document automatic PR healer

[forkwright]

Summary

• replace the superseded per-run gh run rerun ritual with the automatic Release PR checks healer path
• define a non-empty required-check rollup as the observable healthy state and point empty-rollup diagnosis at the healer workflow
• preserve the post-merge tag check and require the later release-attest receipt plus independent provenance verification before calling a release complete

Evidence

• ci: adopt the fleet release-PR healer #930 installed the reusable healer in .github/workflows/release-pr-checks.yml
• Release Please run 33015547810 created chore(main): release 0.9.1 #948 at c187fde44ddd9f1d0396d8750f2e29c337f073ba
• automatic workflow_run healer 33015579668 completed successfully, and chore(main): release 0.9.1 #948 acquired a non-empty check rollup without human approval or reruns

Validation

• kanon gate --tier=nobuild --paths CONTRIBUTING.md — PASS, zero scoped findings
• scripts/check-doc-inventory.sh — PASS
• documented gh run list --workflow "Release PR checks" diagnostic — exercised successfully against the receipt
• one-file/static assertions and git diff --check — PASS
• normal pre-push hook: fmt, workspace check, cargo deny, workspace clippy, and 997/997 nextest tests PASS; full-tree Kanon lint alone fails on the reproduced origin/main debt tracked by standards: gated lint remainder — triage the known-false classes before sweeping #756. Push used --no-verify only after that identical baseline failure; scoped lint is clean.

Closes#949

[forkwright]

APPROVE — exact-head review

Reviewed merge head a2b797ae69e1cf188acb2407dac4031830163bb7 against strict base 1d6e812e8b6d4bd0dd531cab5791ce65dbb6e245. GitHub cannot attach a formal approval because the authenticated reviewer is also the PR author, so this comment records the explicit semantic verdict.

No findings.

• Merge provenance is exact. The head parents are authored f1b1c2e4fedf3a28949a60a341c252bd88fdc794 and base 1d6e812e8b6d4bd0dd531cab5791ce65dbb6e245, with common ancestor 4680d75c373149671db25518f3b0492e4077f10c. Relative to base, the head changes only CONTRIBUTING.md; relative to the authored parent, it adds only #950s .github/workflows/ci.yml delta. Both files are byte-identical to their owning parent, and a fresh git merge-tree --write-tree produced the heads exact tree 4b4342078c04489d6d4a2fd6e2a832cd1dc5a492, proving there is no hidden conflict-resolution delta.
• The healer description matches #930 and the automatic receipt. #930 installed the workflow_run path plus hourly backstop and the required actions: write permission. Run 33015579668 fired as workflow_run immediately after Release Please run 33015547810, identified #948 at c187fde44, approved five held runs, and reported rollup 0 -> 9; #948 now has a non-empty, terminal-green required-check rollup.
• The normal path no longer advises manual reruns. The only fallback commands inspect Release PR checks and failed logs; a repository search found no remaining release-PR gh run rerun ritual. The documented gh run list --workflow Release PR checks and gh run view --log-failed forms execute successfully.
• Release completion remains correctly stricter than merging the release PR: confirm the tag, require the same Release Please runs release-attest job to succeed, require its source tarball plus both CycloneDX SBOM assets, then download the tarball and independently verify its default SLSA provenance with gh attestation verify ... --repo forkwright/thumos. Those requirements match .github/workflows/release-please.yml.
• Required contexts are deliberately not copied into prose; current branch protection confirms Dependabot Auto-Merge is not required.

Local git diff --check, scripts/check-doc-inventory.sh, and kanon gate --tier=nobuild --paths CONTRIBUTING.md pass. All exact-head hosted checks are terminal green, with expected docs-only skips.