fix(release): review polish — promote idempotency, CI hardening, docs

- promote.sh: fail fast before mutating the public tree if the tag was already
  promoted (avoids a half-commit left on the runner on re-dispatch).
- ci-staging.yml: pass STAGING_PROJECT_DIR via env + :? guard instead of a
  ${{ }} expression in run: (clears the template-injection lint, fails loudly
  on misconfig).
- README: PUBLIC_REPO_URL was never read by any workflow — keep only the slug.
- set-repository-url.test.sh: chmod +x for mode parity with promote.test.sh.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/ci-staging.yml

@@ -37,6 +37,8 @@ jobs:
     environment: staging
     steps:
       - name: Update the staging stack
+        env:
+          STAGING_PROJECT_DIR: ${{ vars.STAGING_PROJECT_DIR }}
         run: |
-          cd "${{ vars.STAGING_PROJECT_DIR }}"
+          cd "${STAGING_PROJECT_DIR:?STAGING_PROJECT_DIR not set}"
           sudo ./update.sh

README.md

@@ -179,7 +179,8 @@ staging at GitHub-private, and public users at GitHub-public — automatically.
 
 - Gitea push-mirror → the GitHub-private URL + a GitHub PAT.
 - GitHub-private repo settings:
-  - Variable `PUBLIC_REPO_SLUG` = `owner/repo` of the public repo; `PUBLIC_REPO_URL` if needed.
+  - Variable `PUBLIC_REPO_SLUG` = `owner/repo` of the public repo (the only variable the promotion
+    workflows read).
   - Secret `PUBLIC_REPO_TOKEN` = a token with push to the public repo.
   - (Optional staging) Variable `STAGING_ENABLED=true`, `STAGING_PROJECT_DIR`, and a self-hosted
     runner labelled `clusev-staging` on the internal network (GitHub-hosted runners cannot reach an

scripts/promote.sh

@@ -12,6 +12,13 @@ msg="${4:?commit message required}"
 
 git -C "$src" rev-parse "$tag" >/dev/null 2>&1 || { echo "unknown tag: $tag" >&2; exit 1; }
 
+# Fail fast BEFORE mutating the public tree if this release was already promoted — re-promoting a
+# published release must be deliberate, not a silent half-commit left on the runner.
+if git -C "$pub" rev-parse -q --verify "refs/tags/$tag" >/dev/null 2>&1; then
+    echo "tag already promoted in public repo: $tag" >&2
+    exit 1
+fi
+
 # Clear the public working tree but KEEP its .git.
 find "$pub" -mindepth 1 -maxdepth 1 ! -name '.git' -exec rm -rf {} +