publication prep: gitleaksignore for synthetic test fixtures; releases go manual

ADR-0002 public flip (infra#20): the three gitleaks history findings are
synthetic test fixtures (credential-detector + crypto tests) — ignored
by fingerprint. release.yml moves from tag-trigger to workflow_dispatch:
svu now auto-cuts tags on every release-worthy push, and implicit PyPI
publishes on each bump are not wanted — releases stay deliberate.
Dead ci.yml.disabled dropped.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/ci.yml.disabled

@@ -1,73 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-env:
-  IMAGE_NAME: claude-memory-mcp
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-      - run: pip install -e ".[api,dev]"
-      - run: ruff check src/ tests/
-      - run: mypy src/claude_memory/
-      - run: pytest tests/ -v --tb=short
-
-  build:
-    runs-on: ubuntu-latest
-    needs: test
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    outputs:
-      image_tag: ${{ steps.meta.outputs.sha }}
-    steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - id: meta
-        run: echo "sha=$(echo ${{ github.sha }} | cut -c1-8)" >> $GITHUB_OUTPUT
-      - uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: docker/Dockerfile
-          push: true
-          platforms: linux/amd64
-          tags: |
-            viktorbarzin/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.sha }}
-            viktorbarzin/${{ env.IMAGE_NAME }}:latest
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-  deploy:
-    needs: build
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Trigger Woodpecker deploy
-        run: |
-          for attempt in 1 2 3; do
-            STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
-              "https://ci.viktorbarzin.me/api/repos/78/pipelines" \
-              -H "Authorization: Bearer ${{ secrets.WOODPECKER_TOKEN }}" \
-              -H "Content-Type: application/json" \
-              -d '{"branch":"main","variables":{"IMAGE_TAG":"${{ needs.build.outputs.image_tag }}","IMAGE_NAME":"viktorbarzin/${{ env.IMAGE_NAME }}"}}')
-            if [ "$STATUS" -ge 200 ] && [ "$STATUS" -lt 300 ]; then
-              echo "Woodpecker deploy triggered (HTTP $STATUS)"
-              exit 0
-            fi
-            echo "Attempt $attempt failed (HTTP $STATUS), retrying in 30s..."
-            sleep 30
-          done
-          echo "Failed to trigger Woodpecker deploy after 3 attempts"
-          exit 1

.github/workflows/release.yml

@@ -1,8 +1,7 @@
 name: Release
 
 on:
-  push:
+  workflow_dispatch: {}
-    tags: ["v*"]
 
 jobs:
   docker:

.gitleaksignore

@@ -0,0 +1,5 @@
+# Synthetic test fixtures (credential-detector + crypto tests) — ruled false
+# positives during the ADR-0002 public flip (infra#20). gitleaks skips these.
+0ed5e1e016901abedae2c33049748e938bdfcf67:tests/test_crypto.py:generic-api-key:18
+0ed5e1e016901abedae2c33049748e938bdfcf67:tests/test_credential_detector.py:generic-api-key:113
+0ed5e1e016901abedae2c33049748e938bdfcf67:tests/test_credential_detector.py:private-key:37