release: enforce or document 'stable tags must merge back into master' invariant #235

Follow-up from PR #225 review (F-CR-007).

Current behaviour

lastStableTag() in tools/ci/semver-bump.ts runs git describe --tags --abbrev=0 --match 'v[0-9]*.[0-9]*.[0-9]*' --exclude 'v*-*'. That walks reachable history from HEAD and returns the most recent stable tag whose commit is reachable.

Failure mode

If a maintenance-branch stable cut (e.g. v6.8.1 on a release/6.8.x branch) is never merged back into master, git describe on master will skip past that tag and pick up an older reachable stable — the next dev version computed on master ends up with the wrong base.

Options

Either:

• enforce — CI rejects a stable tag whose commit is not on the master ancestry (a git merge-base --is-ancestor <tag> master check on push), or
• document — release-pipeline.md calls out the invariant explicitly so cutting a stable release on a maintenance branch is understood to require a back-merge into master.

Filed as a follow-up so PR #225 can merge without introducing enforcement scope.