ci(release): production deploys from a pointer branch the pipeline advances

[ABB65]

Implements the deploy model from today's discussion: production binds to a fixed branch that only the release pipeline moves.

The model

• production is a deploy pointer, not an integration branch — no PR targets it, no human commits to it. Its only writer is release.yml's final step.
• The step runs last, after the gate, the image push and the GitHub Release — a tag whose pipeline fails never reaches production.
• Railway's production service binds to production with auto-deploy: advancing the pointer IS the deploy.
• Prereleases do not advance it — same policy that keeps them off the latest image tag.
• Rollback is free: re-run the workflow via workflow_dispatch with the previous tag; the final step points production back at it and Railway redeploys. (Force-push is deliberate — a rollback is never a fast-forward.)

Named production rather than release because release/X.Y is reserved for future maintenance lines (CLAUDE.md), and a branch that answers "what is production running" should say so.

Already done outside this PR

• production branch created at v0.3.0 (b8a18ab) — Railway can be re-bound now, before this merges.

Railway steps (manual, one-time)

1. Prod service → disconnect main / turn off its auto-deploy (do this first — today every merge to main can reach prod)
2. Bind the service to the production branch, auto-deploy on
3. First deploy from the pointer = v0.3.0

Files

• .github/workflows/release.yml — final step: force-push tagged commit to refs/heads/production, stable releases only (contents: write already present; checkout credentials persist by default)
• docs/RELEASING.md — pipeline step 8, new "Production Deploy" section, rollback rewritten around workflow_dispatch
• CLAUDE.md — branch table row for production; main's row no longer claims prod

Not verified

• The pointer step itself has not run in anger — it fires on the next stable release. Until then the branch sits at v0.3.0, which is exactly what prod should run today.
• GITHUB_TOKEN pushes don't trigger other workflows, but Railway listens to webhooks, which do fire for token pushes — expected to work, confirmed only when the next release lands.