[BatmanAoD]

Stacked on #25 (base branch remove-self-pins).
Merge #25 first; this PR must merge after it.

Prototype of release-please as reusable components, for projects with non-Rust parts or version files that release-plz cannot handle.
Draft, alongside the knope workflows: no knope workflow or knope.toml changed.
Design notes and assumptions: agent-choices.md (now covers both #25 and this PR; delete before merging).

Changed by the rebase onto #25

• Dropped the x-release-please-start-version/x-release-please-end blocks around workflow self-pins; refactor!: remove self-pins and the composite actions #25 removed the pins.
• .github/release-please/config.json lists only README.md (the badge) as an extra-file; the .github/workflows/*.yml glob is gone.
• Releasing this repository with release-please therefore no longer needs a token with the workflows permission.
  The caveat remains for consumers whose version files are workflow files.
• Dropped the composite action actions/release-please-lint: refactor!: remove self-pins and the composite actions #25's guard forbids step-level local actions, and the repository ships no composite actions.
  scripts/lint-release-pins stays.
• Dropped the CI step that linted this repository's pins: the self-pin guard already forbids them, and scripts/test-release-please-bump lints the bumped badge against the new version (which fails if the badge loses its annotation).
• scripts/test-release-please-bump checks the badge instead of a workflow pin.
• agent-choices.md from both PRs merged into one file.

What is here

• release-please-pr.yml: dispatch on the default branch, open or update the release PR.
• release-please-draft.yml: after merging that PR, create the release as a draft (no tag yet; GitHub creates it on publish).
  Idempotent: published, draft, and tag-without-release are all handled.
• release-assets-build.yml: optional generic build matrix.
  Any job that uploads release-* artifacts works, rust-cli-build.yml included.
• release-please-publish.yml: attach assets to the draft, check they are all there, then publish.
  No make_latest is sent.
• release-please-prerelease.yml: experimental tag-only prerelease with a local bump commit.
• scripts/lint-release-pins: fails on an unannotated pin, a pin outside the config's extra-files, a pin that disagrees with the manifest, or a malformed marker.
  For callers whose own files pin a repository by tag.
• .github/release-please/{config,manifest}.json: release-type: simple, with the README badge as the only generic extra-file.
  The badge's marker sits after the ), outside knope's regex.
• README section and docs/release-please.md: when to choose which tool, annotation syntax, updater types, release types, commit mapping, token caveats, how to try it.

Design choices that matter

• CLI (release-please@17.11.2), not release-please-action: separate release-pr and github-release commands and --draft.
• Dispatch-only, GITHUB_TOKEN default with secrets.token || github.token inside each called workflow, callers grant the permissions, third-party actions SHA-pinned.
• No new workflow calls another workflow of this repository, so there is no bootstrap order.

GITHUB_TOKEN limit

release-please writes the release PR through the API, and GITHUB_TOKEN cannot create or update files under .github/workflows/.
After #25 this repository's config lists no workflow file, so GITHUB_TOKEN suffices here.
A consumer that lists workflow files needs a token with the workflows permission (the optional token secret).
About 85% confident, from GitHub's documentation; not tried.

Verified (locally, after the rebase)

• yq parse of every workflow; shellcheck clean on the scripts and on every extracted run: block.
• refactor!: remove self-pins and the composite actions #25's self-pin and local-action guards, and scripts/check-inlined-steps, pass.
• scripts/test-lint-release-pins: all fixtures pass (also under /bin/bash 3.2).
• scripts/test-release-please-bump: release-please 17.11.2's own updater over this repository's real files rewrote the badge, kept the v prefix, and changed nothing else.

Not verified

• Any release-please run on GitHub.
  actionlint is not installed locally; CI installs it.
• release-pr and github-release end to end, --draft, the label flow.
• The GITHUB_TOKEN workflow-file limit and the prerelease flow.

Try it on a throwaway repository

Last section of docs/release-please.md.
In short: new private repo, enable Allow GitHub Actions to create and approve pull requests, add a config and manifest, add the caller workflow referencing these workflows at @prototype-release-please, push a feat: commit, dispatch open-pr, merge, dispatch release.

Manual steps for humans

• Throwaway repo and setting above.
• Decide the open questions in agent-choices.md (default "Latest" behavior, vendoring release-please's dependencies, keeping the prerelease flow).

🤖 Generated with Claude Code

https://claude.ai/code/session_01K3mkz6m3aZBokQhgvfjnSv