Remove GitHub prerelease publication from staging workflow

Require explicit user sign-off for merges and mainline releases. Document the pending staging-only artifact replacement.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/docker.yml

@@ -13,11 +13,6 @@ on:
   # the new tag ref instead. The tag mapping below keys off github.ref either
   # way.
   workflow_dispatch:
-    inputs:
-      preview_migrator:
-        description: Publish a commit-specific migrator prerelease for an explicitly pinned staging stack (no npm or fleet promotion)
-        type: boolean
-        default: false
 
 permissions:
   contents: read
@@ -31,49 +26,6 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  preview-migrator:
-    if: github.event_name == 'workflow_dispatch' && inputs.preview_migrator
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    permissions:
-      contents: write
-    steps:
-      - name: Require a non-default branch
-        env:
-          REF: ${{ github.ref }}
-          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-        run: |
-          set -euo pipefail
-          [[ "$REF" == refs/heads/* && "$REF" != "refs/heads/$DEFAULT_BRANCH" ]]
-      - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6
-        with:
-          version: 9.15.4
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 24
-      - run: pnpm install --frozen-lockfile
-      - name: Build matching migrator artifacts
-        run: node scripts/build-preview-migrator.mjs "$RUNNER_TEMP/preview-migrator"
-      - name: Publish immutable candidate assets without promotion
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          tag="preview/$GITHUB_SHA"
-          # Never overwrite an earlier candidate, including a partially
-          # published draft. A failed upload stays inspectable for recovery.
-          if gh release view "$tag" >/dev/null 2>&1; then
-            echo "Preview release already exists; refusing to replace its assets" >&2
-            exit 1
-          fi
-          gh release create "$tag" --target "$GITHUB_SHA" --draft --prerelease --latest=false \
-            --title "Staging preview $GITHUB_SHA" \
-            --notes "Commit-specific Cloud migrator. No npm publish or fleet default promotion. Deploy only to explicitly selected pinned stacks."
-          gh release upload "$tag" "$RUNNER_TEMP/preview-migrator/preview-migrator.json" \
-            "$RUNNER_TEMP/preview-migrator/paperclipai-db.tgz" "$RUNNER_TEMP/preview-migrator/paperclipai-shared.tgz"
-          gh release edit "$tag" --draft=false --prerelease --latest=false
-
   build-and-push:
     runs-on: ubuntu-latest
     timeout-minutes: 60

doc/sandbox-work-folders.md

@@ -134,10 +134,13 @@ acceptance. Record real browser operations, two actual 180-second intervals,
 short-run flushes, independent task checkouts, identity/privacy boundaries,
 interrupted saves, and recovery without the original sandbox or app volume.
 
-`Docker` workflow's optional `preview_migrator` input builds a commit-specific
-GitHub prerelease containing DB/shared tarballs and an integrity manifest. It
-does not publish to npm or advance release channels. Cloud resolves
-`preview:<full SHA>`, verifies artifact identity, migration coverage and the
-dependency lockfile, and permits deployment only to explicitly selected pinned
-stacks. Preview artifacts cannot become the fleet default. A failed or existing
-preview release is never silently overwritten.
+Passing acceptance does not authorize a merge or mainline release. Both require
+the user's explicit sign-off.
+
+Staging migrator artifacts must use a staging-only distribution path; do not
+create GitHub releases to transport them. The initial prerelease publication
+job has been removed. Its replacement remains pending, so the existing
+release-backed preview resolver is not an approved deployment path. The
+replacement must preserve commit identity, artifact integrity, migration
+coverage and dependency-lockfile checks, and restrict deployment to explicitly
+selected pinned staging stacks without changing the fleet default.