ci: automate RC releases; hotfix/* pushes no longer publish

Removes publish_hotfix_release: a hotfix/* branch push published a GA
release to Maven Central with no tag or review (QRun-IO/qbit-cdn#12,
QRun-IO/qqq#1121). hotfix/* branches now run test_only; a hotfix
release publishes from a reviewed vX.Y.Z tag through publish_release.
Adds .github/workflows/release-rc.yml (reusable QRun-IO/.github
qbit-release-rc): a manual dispatch, or merging a develop PR labelled
release:rc, merges develop into the release line and the release/* push
runs the existing CircleCI RC publish.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.circleci/config.yml

@@ -11,7 +11,7 @@ workflows:
           context: [ qqq-maven-registry-credentials ]
           filters:
             branches:
-              ignore: /(develop|main|release/.*|hotfix/.*|integration.*)/
+              ignore: /(develop|main|release/.*|integration.*)/
             tags:
               only: []
 
@@ -44,14 +44,4 @@ workflows:
             branches:
               only: [ main ]
             tags:
-              only: [ /v.*/ ]
-
-  publish_hotfix_release:
-    jobs:
-      - qqq-orb/mvn_publish:
-          context: [ qqq-maven-registry-credentials ]
-          branch_type: hotfix
-          filters:
-            branches:
-              only:
-                - /hotfix\/.*/
+              only: [ /^v\d+\.\d+\.\d+$/ ]

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @KofTwentyTwo

.github/workflows/release-rc.yml

@@ -0,0 +1,25 @@
+# Cut the next release candidate (QRun-IO/qqq docs/QRUN-QBIT-REPO-STANDARD.md, C6):
+# run this workflow by hand, or merge a develop PR labelled `release:rc`. It merges develop into
+# the release line and the release/* push runs CircleCI publish_release_candidate.
+name: Release candidate
+
+on:
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Print the plan without merging or creating branches
+        type: boolean
+        default: false
+  pull_request:
+    types: [closed]
+    branches: [develop]
+
+permissions:
+  contents: write
+
+jobs:
+  release-rc:
+    if: github.event_name == 'workflow_dispatch' || (github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'release:rc'))
+    uses: QRun-IO/.github/.github/workflows/qbit-release-rc.yml@main
+    with:
+      dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}

CLAUDE.md

@@ -0,0 +1,15 @@
+# qbit-crm
+
+## Knowledge base
+
+Reviewed dossiers for this repo and the QQQ platform live in the second-brain vault:
+
+- Hub / start here: `R:/Git.Local/KofTwentyTwo/second-brain/knowledge/qqq/qqq-hub.md`
+- This repo's dossier: `R:/Git.Local/KofTwentyTwo/second-brain/knowledge/qqq/repos/qbit-crm.md`
+  (reviewed commit `76b95c91ee7e`, branch `develop`, 2026-07-04)
+- QBit mechanics refresher: `knowledge/qqq/architecture/metadata-model.md` in the same vault
+
+Key facts captured there: parent pom `qbit-build-parent:1.4.0` pins qqq to 0.27.9 (via
+`qqq-bom-pom` import); two BREAK-04 compile breaks block a qqq 4.0 upgrade
+(`BaseTest.setAuthentication`, `EnrollInSequenceProcess input.getSession()`); Maven
+Central's published `0.1.0` predates the AGPL→Apache license switch and the audit fixes.