docs: release pipeline (3-repo promotion, channels, wiring)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -159,6 +159,44 @@ e-mail are preserved. (The older two-step `git pull && sudo ./install.sh` still
 
 ---
 
+## Release pipeline (maintainers)
+
+Clusev is promoted across three repositories, dev → staging → public:
+
+1. **Gitea (private)** — sole development source. Commit + tag here.
+2. **GitHub private** — a push-mirror of Gitea (Gitea → Settings → Mirror). Runs CI; betas are tested
+   on the staging server.
+3. **GitHub public** — receives only released versions: one clean commit per release, beta and stable
+   tags. Public users install/update from here.
+
+Channels follow semver tags: **beta** = `vX.Y.Z-betaN`, **stable** = `vX.Y.Z`.
+
+No private repo URL is committed: `config/clusev.php` defaults `repository` to empty, `install.sh`
+derives `CLUSEV_REPOSITORY` from the clone origin into the (gitignored) `.env`, so dev points at Gitea,
+staging at GitHub-private, and public users at GitHub-public — automatically.
+
+### One-time wiring (when the GitHub repos exist)
+
+- Gitea push-mirror → the GitHub-private URL + a GitHub PAT.
+- GitHub-private repo settings:
+  - Variable `PUBLIC_REPO_SLUG` = `owner/repo` of the public repo; `PUBLIC_REPO_URL` if needed.
+  - Secret `PUBLIC_REPO_TOKEN` = a token with push to the public repo.
+  - (Optional staging) Variable `STAGING_ENABLED=true`, `STAGING_PROJECT_DIR`, and a self-hosted
+    runner labelled `clusev-staging` on the internal network (GitHub-hosted runners cannot reach an
+    internal staging host).
+  - Environment `production` with a required reviewer (gates the promotion workflows).
+- Public repo's clone command goes in its own README; set `CLUSEV_REPOSITORY` default in
+  `config/clusev.php` to the public URL once known.
+
+### Promoting
+
+- **To staging:** push a beta tag `vX.Y.Z-betaN` (CI tests; staging deploys if enabled, else update it
+  from the Versions page).
+- **To public (beta):** run the `Promote to public (beta channel)` workflow with the beta tag.
+- **To stable:** run the `Promote beta to stable` workflow with the beta tag + the stable tag.
+
+---
+
 ## Security & recovery
 
 The **forgot-password** screen offers self-service recovery: an **e-mail reset link** (valid 15