ci: retire publish-agent-image.yml, folded into the unified release lane (RIG-2994)

.github/workflows/ci.yml

@@ -1722,7 +1722,7 @@ jobs:
         # published `:latest` turns on one question — does this PR change the
         # image's inputs? — and the answer already lives in one place: the
         # `compass-agent-image` build task's `inputs` globs (agent-image/moon.yml),
-        # which mirror publish-agent-image.yml's on.push.paths (the reviewed
+        # which mirror release.yml's IMAGE_CLOSURE_PATHS (the reviewed
         # source of truth for what changes the published artifact).
         #
         # The discriminator is `moon query tasks --affected --project

docs/architecture/build-and-ci.md

@@ -185,8 +185,9 @@ the release jobs — the four-binary asset set is built stamped from `version.tx
 the `:vX.Y.Z` image tag. Dev/bundle builds off `app-bundle/build.sh` read the
 same `version.txt` base and append a `+g<shortsha>` suffix, so a local bundle
 reports the release base it descends from. The standalone
-`publish-agent-image.yml` predates this unification; its retirement is a
-separate follow-up.
+`publish-agent-image.yml` predated this unification; it has been retired
+(RIG-2994), its per-push publish duty relocated verbatim into `release.yml`'s
+`publish-image` job.
 
 **Smoke.** On a runner host, pull the immutable tag and drive the consumer seam:
 

docs/designs/infra/ci/compass-agent-image-publish/design.md

@@ -21,10 +21,12 @@ Tracking: RIG-1690 (blocks compass-native RIG-1683/T2, RIG-1685/T4, RIG-1687/T6)
 > DL-298–301). That lane RELOCATES this lane's per-push publish DUTY verbatim —
 > the same `publish.sh` no-args call, the same closure-paths gate, the same
 > serialize / immutability / two-copy-coherence / least-privilege /
-> off-hot-path posture — into a `publish-image` job, and the standalone
-> workflow FILE retires in a two-PR staged delete (land the fold, observe one
-> green per-push run, then delete). Every OTHER decision here stays live and is
-> carried into that lane unchanged: the tag name/tag contract (`:git-<sha>`
+> off-hot-path posture — into a `publish-image` job. The standalone
+> `publish-agent-image.yml` workflow FILE has now been RETIRED (RIG-2994,
+> 2026-08-30) via the two-PR staged delete this note prescribed: the unified
+> lane's fold landed, one green per-push `publish-image` run was observed on
+> main, and the old file was then deleted. Every OTHER decision here stays live
+> and is carried into that lane unchanged: the tag name/tag contract (`:git-<sha>`
 > immutable pin + `:latest` fallback), the build-once/push-each-tag skopeo
 > mechanism, the `GITHUB_TOKEN` + `REGISTRY_AUTH_FILE` auth pin, the
 > `linux/amd64` single-arch platform contract, and the public-visibility

tools/release-notes/index.ts

@@ -137,7 +137,7 @@ export function assemble(input: AssembleInput): AssembleOutput {
 
 // ── The edge (impure) ──────────────────────────────────────────────────────
 
-/** The GHCR repo the agent image publishes to (publish-agent-image.yml:188). */
+/** The GHCR repo the agent image publishes to (release.yml publish-image). */
 const IMAGE_REPO = "ghcr.io/rigelbuild/compass-agent";
 
 type Args = {
@@ -266,7 +266,7 @@ export function requireImageAtRelease(
 
 /**
  * Query GHCR for the image config digest at :git-<sha12>, exactly as
- * publish-agent-image.yml:206 does (`skopeo inspect --raw … | jq -r
+ * release.yml's publish-image verify does (`skopeo inspect --raw … | jq -r
  * .config.digest`). Returns null when the tag is not published — the image lane
  * is paths-filtered independently, so a go-only push has no image for its sha.
  */