chore(ci): fork release hygiene and publishing docs

[DevFlex-AI]

Cleans up the inherited GitHub Actions setup so the fork can't accidentally publish or fail on Zoo-internal automation, and documents what a maintainer must configure to publish under the bolt-builder publisher.

The important change is that the nightly pre-release no longer fires on every push to main:

on:
  # Manual-only: the fork does not auto-publish a pre-release on every push to
  # main. Trigger a nightly deliberately from the Actions tab when wanted.
  workflow_dispatch:

Left as-is, that workflow would publish a public pre-release to the Marketplace on every merge the moment VSCE_PAT exists. (The stable marketplace-publish.yml is already safe: it only runs on a v*.*.* tag and hard-asserts the bolt-builder/bolt-code identity, so it stays untouched.)

Also removed as Zoo/Roo-internal or leaky:

• release-reminder.yml — Friday Discord webhook pinging upstream team members; fails every week on a fork.
• cli-release.yml — builds a CLI the fork doesn't ship and embeds RooCodeInc/Roo-Code install URLs (the last hardcoded upstream repo reference in .github/).
• .github/actions/slack-notify/ — dead composite action, referenced by no workflow.

Renamed the CI workflow from "Code QA Roo Code" to "Code QA", and added a root PUBLISHING.md documenting the required secrets (VSCE_PAT, optional OVSX_PAT/POSTHOG_API_KEY/CODECOV_TOKEN), the marketplace-production/marketplace-prerelease environments, and the tag-driven release flow. Kept CI, e2e, CodeQL, visual-regression, and release-validation as-is; Codecov upload steps stay but fail softly until a token is added. Telemetry key plumbing is untouched so opt-in still works (see the telemetry PR).

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

[coderabbitai]

Warning

Review limit reached

@DevFlex-AI, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 30 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 02e246c4-460d-4fde-9d47-91500c93f18c

📥 Commits

Reviewing files that changed from the base of the PR and between 0e99df8 and 0ce7371.

📒 Files selected for processing (6)

• .github/actions/slack-notify/action.yml
• .github/workflows/cli-release.yml
• .github/workflows/code-qa.yml
• .github/workflows/nightly-publish.yml
• .github/workflows/release-reminder.yml
• PUBLISHING.md

---

_{Comment @coderabbitai help to get the list of available commands.}

[DevFlex-AI]

@codesmith-bot fix all emrge conflcits thne push to this pr

[blacksmith-sh]

@DevFlex-AI

@codesmith-bot fix all emrge conflcits thne push to this pr

Merge conflicts on PR #4 are resolved: #4 is now MERGEABLE.

The conflicts came from two stray i18n commits pushed onto ci-release that had also landed on main in reviewed form via PR #3. The fix was to rebuild the branch as main + only this PR's CI/release commit, dropping the superseded duplicates (nothing lost — main already carries the newer versions with stricter test assertions). The background autofix session landed that exact resolution moments before my push, so the branch head (0ce7371) matches my resolution byte-for-byte and no further push was needed.