ci(release): tag/chart-version guard + strict stability rule (release train)

[LukasWodka]

What (backend#1301, Q5 — approved by Lukas)

Two guards in release-helm-chart.yaml, running before lint/package on every published release:

1. tag ↔ chart version: the tag's base X.Y.Z must equal client/Chart.yaml's version — train-cut or manual — so the chart version can never go silently stale after an out-of-train release.
2. Strict stability: any non-plain-semver tag (e.g. v1.9.7-rc.1, or a malformed v1.9.7rc1) must be marked pre-release — otherwise it would become latest (what the installer bootstrap resolves) and enter the helm index as stable.

Tag reaches the script via env, never interpolated (R8, backend#889).

Context

client is joining the release train: staging hop → train creates pre-release v1.X.Y-rc.N (rc numbering strictly numeric) → FR from the rc's own stamped installer; prod hop → stable v1.X.Y. The stamped-installer flow needs zero changes — the fail-closed guard is placeholder-based, so rc-stamped installers verify at their own tag as-is. Helm-side safety: helm install excludes pre-release chart versions unless --devel/explicit --version.

Test plan

• actionlint clean
• First rc after merge+App-install: verify the guard passes, the release is marked pre-release, releases/latest still points at the last stable, and helm search repo tracebloc -l --devel shows the rc

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes release automation and can edit GitHub release metadata (prerelease demotion) and block publishing on mismatch; it does not alter runtime app code but affects what becomes latest and what ships on publish.

Overview
Adds a verify job that runs before Helm packaging and installer manifest signing on every published release, so bad releases no longer get charts or stamped installers attached.

The guard compares the release tag’s base X.Y.Z to client/Chart.yamlversion and fails the workflow if they differ (chart must be bumped first). For tags that are not plain vX.Y.Z but were published as stable, it demotes the GitHub release to prerelease first so latest (installer bootstrap) does not point at an RC or malformed tag; demotion runs before the version check so a doubly-broken release still loses latest. The tag is passed only via env, not shell interpolation.

release and sign-installer-manifest now needs: verify.

^{Reviewed by Cursor Bugbot for commit a134974. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c61982c. Configure here.}