ci: stop publishing the alien CLI distribution from this repo

.github/RELEASING.md

@@ -17,7 +17,6 @@ The **Release qualification** check then:
 
 - builds and smoke-tests every native addon, binary, and container image;
 - packs every Cargo and npm package;
-- creates the changelog, archives, and checksums;
 - records the source Git tree plus every artifact checksum and image digest.
 
 Qualification artifacts are retained for 30 days. If they expire, rerun
@@ -51,10 +50,12 @@ existing version only when its crates.io checksum matches.
 If publication stops, fix the external failure and rerun the same publish
 action. Never prepare another version to recover a partial release.
 
-The immutable Git tag and GitHub release are created only after package
-registries, images, and versioned binary objects have accepted the qualified
-artifacts. Homebrew is updated last because its formula references the GitHub
-release assets. After every destination succeeds, the workflow atomically
-updates `channels/stable`; clients resolve that one pointer before downloading
-immutable versioned binaries. Stable releases never update a collection of
-independent `latest` objects.
+The immutable Git tag is created only after package registries, images, and
+versioned binary objects have accepted the qualified artifacts.
+
+This workflow does not publish the `alien` CLI, its npm package, the GitHub
+release, the Homebrew formula, or the `channels/stable` pointer. The official
+CLI distribution publishes those from the release tag: it builds `alien`,
+creates the immutable GitHub release with the changelog (rendered from
+`cliff.toml`) and the archives of `alien` plus this release's binaries, then
+updates Homebrew and, last, `channels/stable`.

.github/workflows/release-stable.yml

@@ -78,7 +78,7 @@ jobs:
             if ! jq -e '
               (length > 0) and
               (any(.[]; .name == "qualify / prepare" and .conclusion == "success")) and
-              (any(.[]; .name == "qualify / qualify-github-release" and .conclusion == "success")) and
+              (any(.[]; .name == "qualify / qualify-images" and .conclusion == "success")) and
               (all(.[]; .conclusion == "success" or .conclusion == "skipped"))
             ' <<< "$qualified_jobs" >/dev/null; then
               echo "::error::Prior qualification jobs did not all pass"
@@ -94,9 +94,9 @@ jobs:
               ai-gateway-bin-linux-arm64 ai-gateway-bin-linux-x64 \
               binaries-aarch64-apple-darwin binaries-aarch64-unknown-linux-musl \
               binaries-x86_64-pc-windows-msvc binaries-x86_64-unknown-linux-musl \
-              changelog qualified-ai-gateway qualified-bindings \
-              qualified-client-sdks qualified-crates qualified-github-release \
-              qualified-image-digests qualified-npm qualified-npm-cli \
+              qualified-ai-gateway qualified-bindings \
+              qualified-client-sdks qualified-crates \
+              qualified-image-digests qualified-npm \
               qualified-python-linux-aarch64 qualified-python-linux-x86_64 \
               qualified-python-macos-aarch64 qualified-python-macos-x86_64; do
               if ! jq -e --arg name "$required" 'index($name) != null' \

scripts/README.md

@@ -4,7 +4,6 @@ Small operational scripts used by root `package.json` commands and GitHub Action
 
 ## Release
 
-- **`build-npm-packages.sh`** — Used by `.github/workflows/release.yml` to package and publish `@alienplatform/cli` from downloaded binary artifacts. Requires `VERSION`, `NODE_AUTH_TOKEN`, and the release workflow artifact layout under `./artifacts/`.
 - **`smoke-sandbox-agent.sh`** — Used by `.github/workflows/release.yml` to qualify the published `alien-sandbox-agent` image on both `linux/amd64` and `linux/arm64`, and usable on any GCP sandbox image built from the same contract. Takes the image reference and needs a Docker daemon that can pull it. `--platforms` narrows the platforms probed, and `--tools docker/sandbox-default-tools.txt` also runs every tool of the default sandbox base as the image's user. `scripts/smoke-sandbox-agent.test.sh` runs every probe and every failure mode against a stub `docker`, so the script itself is testable without a daemon or an image.
 
 ## Test environment