ci: automate RC releases; hotfix/* pushes no longer publish

Removes publish_hotfix_release: a hotfix/* branch push published a GA
release to Maven Central with no tag or review (QRun-IO/qbit-cdn#12,
QRun-IO/qqq#1121). hotfix/* branches now run test_only; a hotfix
release publishes from a reviewed vX.Y.Z tag through publish_release.
Adds .github/workflows/release-rc.yml (reusable QRun-IO/.github
qbit-release-rc): a manual dispatch, or merging a develop PR labelled
release:rc, merges develop into the release line and the release/* push
runs the existing CircleCI RC publish.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.circleci/config.yml

@@ -11,7 +11,7 @@ workflows:
           context: [ qqq-maven-registry-credentials ]
           filters:
             branches:
-              ignore: /(develop|main|release/.*|hotfix/.*|integration.*)/
+              ignore: /(develop|main|release/.*|integration.*)/
             tags:
               only: []
 
@@ -44,14 +44,4 @@ workflows:
             branches:
               only: [ main ]
             tags:
-              only: [ /v.*/ ]
-
-  publish_hotfix_release:
-    jobs:
-      - qqq-orb/mvn_publish:
-          context: [ qqq-maven-registry-credentials ]
-          branch_type: hotfix
-          filters:
-            branches:
-              only:
-                - /hotfix\/.*/
+              only: [ /^v\d+\.\d+\.\d+$/ ]

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @KofTwentyTwo

.github/workflows/release-rc.yml

@@ -0,0 +1,25 @@
+# Cut the next release candidate (QRun-IO/qqq docs/QRUN-QBIT-REPO-STANDARD.md, C6):
+# run this workflow by hand, or merge a develop PR labelled `release:rc`. It merges develop into
+# the release line and the release/* push runs CircleCI publish_release_candidate.
+name: Release candidate
+
+on:
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Print the plan without merging or creating branches
+        type: boolean
+        default: false
+  pull_request:
+    types: [closed]
+    branches: [develop]
+
+permissions:
+  contents: write
+
+jobs:
+  release-rc:
+    if: github.event_name == 'workflow_dispatch' || (github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'release:rc'))
+    uses: QRun-IO/.github/.github/workflows/qbit-release-rc.yml@main
+    with:
+      dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}

CLAUDE.md

@@ -0,0 +1,13 @@
+# qbit-wms
+
+QBit plugin for the QQQ platform: a complete Warehouse Management System (46 tables, 47 processes, 11 widgets, task-centric work engine, perpetual inventory ledger).
+
+## Knowledge base
+
+Reviewed dossiers for this repo and the wider QQQ platform live in the second-brain vault:
+
+- Platform hub: `R:/Git.Local/KofTwentyTwo/second-brain/knowledge/qqq/qqq-hub.md`
+- QBit mechanics: `R:/Git.Local/KofTwentyTwo/second-brain/knowledge/qqq/architecture/metadata-model.md`
+- This repo's dossier: `R:/Git.Local/KofTwentyTwo/second-brain/knowledge/qqq/repos/qbit-wms.md`
+
+Dossier reviewed at commit `f8c255148974` (branch `develop`, 2026-07-04). Key facts captured there: qqq pin 0.27.9 via `qbit-build-parent:1.4.0`, AGPL-3.0 licensing (no source headers), Gen-2 `QBitMetaDataProducer` contract, dead-config findings (only `backendName` + `recordSecurityLocks` consumed), phase plan tracked in QRun-IO/qqq issues #420-431, and v4.0 upgrade exposure (test-only BREAK-04-11 hit; Java 17 vs 21 floor).