Retro #35: los prerrequisitos de publicación (entorno release, secretos, ruleset de tags) no están escritos en ningún lado #5

Finding (retrospective of instalador #35, severity: low)

Territorio's flip found its release environment already configured; IntraVox's did not — the environment, both APP_SIGNING_KEY* secrets and (by luck, not process) the v-tags-owner-only ruleset were created mid-flight, discovered by comparing repos over the API. Parent #27's P0 lists the owner's setup steps once, in a body nobody re-reads per app.

Fix

One paragraph in app-release.yml's header (the contract every caller reads before wiring itself): a release repo needs the release environment carrying the two secrets, and a v* tag ruleset restricting tags to the owner. Comment-only change; existing SHA pins are unaffected.