🚀 release: clarify build flow workflow naming

[warengonzaga]

Promote #9 from dev to main so the repository's Build Flow entry point is named .github/workflows/build-flow.yml. Update workflow links and npm trusted-publisher instructions to match. The workflow contents, triggers, permissions, pinned action, and engine source are unchanged.

Clean Workflow review is complete at b2753008a3f32963e586086e8121607bc0228c3d against main 4052caa14ecefcd98d910685d896c73710c825db. Independent review and Copilot found no issues; there are no unresolved threads. Byte-for-byte workflow comparison, YAML parsing, stale-reference search, whitespace checks, and regular-merge simulation passed. The merge preserves main's changelog and release history.

Both promotion CI and dev CI passed, including Node 22/24/26 and CodeQL scans. The PR has 15 successful checks, ten expected publication/release skips, and one neutral CodeQL comparison. GitHub cannot compare introduced alerts against main's old .github/workflows/build.yml:scan configuration after the rename; the scan itself succeeded. That comparison limitation is not a passed check.

Use a regular merge commit and preserve dev. This setup-only change does not request a package version bump. When completing npm Trusted Publishing setup, use build-flow.yml as the trusted caller filename. npm account configuration and initial publication are separate; this PR does not perform either.

[Copilot]

Copilot review overview

🟢 Approval recommended

The rename preserves workflow contents and all repository references consistently use the new filename.

Review effort: Balanced
Findings: None

What changed in this PR

Renames the Build Flow workflow and aligns release documentation with the new filename.

Changes:

• Renames build.yml to build-flow.yml without content changes.
• Updates workflow links and npm Trusted Publishing instructions.

File	Description
.github/​workflows/​build-flow.yml	Renamed Build Flow entry point.
AGENTS.md	Updates workflow references.
docs/​RELEASING.md	Updates release link and trusted-publisher filename.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[warengonzaga]

Clean Workflow complete for b275300 against main 4052caa. No actionable findings or unresolved threads. The promotion contains only the byte-identical workflow rename and matching documentation references. Independent review and Copilot are clean; the regular merge is conflict-free and preserves main's changelog/history.

Current-head CI is complete: 15 successful checks, ten expected skips, and one neutral CodeQL comparison. Node 22/24/26 and the CodeQL scans passed. Introduced-alert comparison against the old build.yml scan identity is unavailable after the rename and is explicitly disclosed. YAML, reference, and whitespace checks also pass. No extra code changes were needed.

Ready for the regular dev-to-main merge decision; preserve dev. npm trusted-publisher setup must use build-flow.yml before a future package publication. No main merge or publication was performed during this review.