Manage releases with bake-gem-github

[samuel-williams-shopify]

Move Presently from local gem publishing to reviewed release PRs and GitHub Actions publishing with bake-gem-github. Keep the version-bump hook that updates release notes and documentation, and remove the legacy hook that separately creates GitHub releases.

• Generate prepare, validate, and publish workflows plus release configuration and ruleset payloads using bake-gem-github 0.6.0. Include the supported Ruby matrix, coverage, RuboCop, JavaScript, and package checks; omit experimental Ruby.
• Replace release.cert with the shared Socketry certificate, use ~/.gem/socketry-release.pem for local signing, and include the public certificate in the gem.
• Update the README release command to prepare a release PR.

Validation: RuboCop passes (85 files); release validation against origin/main passes; unsigned and signed gem builds succeed. Verified the signed gem uses the new certificate and that the packaged certificate matches. Generated configuration is unchanged when regenerated, and workflow YAML/ruleset JSON parse successfully.

Activation after merge: apply the generated repository rules with bundle exec bake gem:github:setup:apply once Release validation is available. The policy requires two PR approvals with explicit administrator bypass and protects main and version tags. RubyGems Trusted Publisher registration uses bundle exec bake gem:github:setup:publisher (owner login/MFA), with repository socketry/presently, workflow release-publish.yaml, and environment rubygems. The organization already supplies GEM_SIGNING_KEY to all repositories.

The rubygems GitHub environment is configured to accept deployments only from the main branch.