Reduce duplicate post-merge checks in release-please flow

.github/copilot-instructions.md

@@ -15,6 +15,7 @@
 - Release automation is handled by `release-please`; keep `release-please-config.json` and `.release-please-manifest.json` aligned with the latest published tag, keep root tags in the existing plain `v*` format, and prefer Conventional Commit subjects (`fix:`, `feat:`, `deps:`) so release PRs are generated correctly.
 - Merged release PRs are finalized by `.github/workflows/release.yml`: the workflow detects `chore(main): release ink x.y.z` merges, creates the canonical `v*` tag plus a compatibility `ink-v*` tag, publishes the GitHub release from `v*`, and clears stale `autorelease:*` labels so the next release PR is not blocked.
 - Protected-branch repos should prefer a `RELEASE_PLEASE_TOKEN` PAT for the release workflow so bot-created release PRs trigger the normal PR checks.
+- In this repo, `main` is protected and all changes land through PRs, so `.github/workflows/pr-checks.yml` is the validation gate, `.github/workflows/codeql.yml` runs on PRs plus schedule, and `.github/workflows/release.yml` should only assemble `ink-app.html` and publish the release instead of rerunning the full test suite after merge.
 - Contributor-facing workflow and validation steps now live in `CONTRIBUTING.md`; keep build, test, and single-file output guidance aligned with that document when project workflows change.
 - Declarative WebMCP note creation lives in the `#webmcpNoteForm` form in `ink.template.html`; keep its submit path wired to `createNoteFromTool()` in `src/app/workspace-io.ts` so agent-invoked note creation stays in the single-page app and does not navigate away.
 - Cogito Mode work is tracked in `openspec/changes/add-cogito-mode/`; preserve the strict three-question JSON contract and the markdown insertion block format (`> ### AI` then question text) when implementing it.

.github/workflows/codeql.yml

@@ -12,8 +12,6 @@
 name: "CodeQL Advanced"
 
 on:
-  push:
-    branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
   schedule:

.github/workflows/release.yml

@@ -85,13 +85,9 @@ jobs:
         if: ${{ steps.merged_release.outputs.is_release_merge == 'true' }}
         run: npm ci
 
-      - name: Build
+      - name: Assemble release artifact
         if: ${{ steps.merged_release.outputs.is_release_merge == 'true' }}
-        run: npm run build
-
-      - name: Run tests
-        if: ${{ steps.merged_release.outputs.is_release_merge == 'true' }}
-        run: npm test
+        run: node build/compile-and-assemble.js
 
       - name: Create release tags
         if: ${{ steps.merged_release.outputs.is_release_merge == 'true' }}

CONTRIBUTING.md

@@ -69,6 +69,7 @@ Feature ideas are welcome. Open an issue describing the problem you want to solv
 - When a release PR is merged, the release workflow finalizes it by creating the plain `v*` tag, adding a compatibility `ink-v*` tag for release-please state reconciliation, publishing the GitHub release from `v*`, and clearing stale autorelease labels.
 - Merge the release PR through the normal protected-branch flow to create the Git tag and publish the GitHub release.
 - If you want the release PR to trigger the normal PR checks automatically, configure a `RELEASE_PLEASE_TOKEN` secret with a PAT that can open pull requests in this repository.
+- CI validation should happen in PR workflows before merge; the release workflow is intentionally limited to regenerating `ink-app.html` for the tagged release artifact instead of rerunning the full build/test suite after the protected-branch merge.
 
 ## Style Guide