docs(process): document how the release pipeline works today

[martyy-code]

Summary

Adds docs/engineering/process/release-pipeline.md — a process-oriented reference describing the release pipeline as it actually runs today. Companion to the design and setup docs:

• docs/engineering/plans/release-pipeline.md — why (design rationale, migration history, security properties).
• docs/engineering/plans/release-pipeline-github-ui-setup.md — how to set it up (one-time UI steps).
• docs/engineering/process/release-pipeline.md — how to use it (this PR).

Sections

1. What the system does — end-to-end description of what happens when a changeset PR merges.
2. The single workflow publish.yml — triggers, the single release job, step sequence, changeset detection, concurrency.
3. Security model — trust chain, gates that must close, why we don't use tag protection / reusable workflows / NPM_TOKEN fallback, provenance attestation.
4. Day-to-day operations — cutting a release, cutting a hotfix, manual dry-run, re-running after transient failure.
5. Branch strategy — direct PRs to main, why staging/dev were abandoned.
6. Trust boundary with npm — Trusted Publisher, publishing access, OIDC audience.
7. What this pipeline does not do — explicit non-goals (multi-package, pre-release, pkg.pr.new, automated rollback).
8. Local debugging — what you can verify offline and what you can't.
9. Auditing a past release — commands to find a release commit, verify provenance, find the workflow run, and verify the GitHub Release.
10. References.

Audience

• Engineers cutting their first release — §1, §4.1.
• Engineers handling a hotfix — §4.2.
• Engineers debugging a failed run — §4.4.
• Auditors and reviewers — §3, §9.
• New maintainers onboarding — read in order, top to bottom.

Test plan

• pnpm turbo type-check passes.
• pnpm turbo lint passes.
• Manual review for technical accuracy.

Risk

None. Documentation only.

🤖 Generated with Claude Code