10.x line follow-ups: protect release/v10, publish 10.3.48 marker, reconcile docs/pipeline

[ChrisonSimtian]

Branches have been tidied (2026-05-29):

• release/v10.3 → release/v10 (the 10.x maintenance line; carries the 10.3.48 marker commit a248d987)
• release/v10.1 → hotfix/v10.1
• release/v10.2 → hotfix/v10.2

Remaining follow-ups for the 10.x line:

• Publish the 10.3.48 clean marker from release/v10 (deferred until after the rename — now done). The earlier marker run on the old release/v10.3 was cancelled. Re-trigger from release/v10 and approve the nuget-org gate. Verify nbgv get-version = 10.3.48 first.
• Apply branch protection to release/v10 (currently unprotected — standard release/vN profile: required ubuntu-latest, linear history, no direct/force push).
• Reconcile the pipeline — release/v10 still has the simpler push-triggered release.yml from chore(release): stage clean 10.3.48 marker on release/v10.3 #296; main uses the tag-triggered multi-channel model (Refactor release.yml: tag-triggered, multi-channel via environments #274/ci(release): nuget.org publish is opt-in; GitHub Packages is the v11 default channel #299). Decide whether release/v10 adopts tag-triggered + nuget.org-opt-in.
• Update docs to the final names: docs/agents/release-and-versioning.md (per-minor model from docs(agents): document per-minor release/v10.x maintenance lines #289), docs/branching-and-release.md, ADR docs/adr/0001-release-branch-model.md — reflect one release/v10 line + hotfix/v10.x for older minors.

Context: contamination boundary 10.3.23 clean / 10.3.24+ contaminated; nuget.org cleanup done (10.3.24–47 + all 11.0.x unlisted).

[ChrisonSimtian]

Marker publish is blocked by a Build.cs gate — coupled to the pipeline reconciliation.

release/v10's (#170-era) Build.cs hard-gates publishing to main:

• IPublish.Publish → .Requires(() => GitRepository.IsOnMainBranch() && …)
• ICreateGitHubRelease.CreateGitHubRelease → .OnlyWhenStatic(() => IsOnMainBranch())

So ./build.cmd Test Pack Publish from release/v10 no-ops at the publish step. This is why #274's new pipeline packs + raw dotnet nuget push instead of using the Publish target.

To ship the 10.3.x marker (will be 10.3.49 after the config fixup commit bumps git-height), the 10.x line needs one of:

1. Patch release/v10 Build.cs to allow publishing from release/v* (un-gate IsOnMainBranch), or
2. Port the new pipeline's pack + raw dotnet nuget push approach to release/v10.

Plus the already-known config fixup: version.json publicReleaseRefSpec and release.yml push trigger still reference the old release/v10.3 (rename leftovers) → must point at release/v10.