docs: clarify release publication workflow

AGENTS.md

@@ -37,6 +37,8 @@
 - For release preparation, read `RELEASING.md` before changing versions, changelog entries, release commits, or tags.
 - Use `npm version <version> --workspaces --include-workspace-root --no-git-tag-version` to keep workspace package versions aligned without creating an automatic tag.
 - Use annotated release tags (`git tag -a`) so `--follow-tags` and the release workflow pick them up.
+- Create and push the release tag only after the release commit is merged into `origin/main`; run `git fetch origin` and `git merge-base --is-ancestor <release-commit> origin/main` first.
+- Before calling a release complete, use `git ls-remote --tags origin "refs/tags/vX.Y.Z^{}"` to verify the remote tag resolves to the merged release commit, then confirm the GitHub release contains its notes and source archives.
 - If `npm run release:check` fails with `ELOOP` under `specs/specs/...`, inspect the worktree for a local recursive `specs` symlink before changing tracked files.
 
 ## Static Data and Reference Content

CHANGELOG.md

@@ -17,7 +17,7 @@ The format is based on Keep a Changelog and this project follows Semantic Versio
 
 - **Project license** — switched the project license from MIT to Apache License 2.0 and updated the README badge.
 - **Changelog category workflow** — `AGENTS.md` now requires changelog updates to preserve Keep a Changelog category headings and place entries under the appropriate `Added`, `Changed`, `Fixed`, `Removed`, or `Security` section instead of flattening release notes.
-- **Release workflow guidance** — `AGENTS.md` now records the release-prep workflow for reading `RELEASING.md`, keeping workspace versions aligned, using annotated tags, and checking local recursive `specs` symlink artifacts before changing tracked files when release checks hit `ELOOP`.
+- **Release workflow guidance** — `AGENTS.md` now records the release-prep workflow for reading `RELEASING.md`, keeping workspace versions aligned, publishing annotated tags only from merged `origin/main` release commits, verifying remote releases, and checking local recursive `specs` symlink artifacts before changing tracked files when release checks hit `ELOOP`.
 - **Run fatal upstream errors** — Run-created benchmark profiles now cancel on the first fatal upstream error, context-window retrieval stops on the first failed item, and HTTP diagnostics preserve upstream provider codes such as `prefill_memory_exceeded`.
 - **Run template capability filtering** — Run now disables benchmark templates that exceed a selected model's declared context window or require tool calling when the selected model/server is not tool-capable.
 - **Run audit and functional checks split** — Run now separates pipeline execution health from functional benchmark checks, and treats missing required terms as a visible functional failure when exact matching is disabled.