ci: make client packaging manual

Reduce Actions time by keeping only Server release automatic on main; Client matrix is manual.

.github/workflows/repository-hygiene.yml

@@ -107,8 +107,7 @@ jobs:
   release-application:
     needs: validate
     if: >-
-      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
-      needs.validate.outputs.client_scope == 'true'
+      github.event_name == 'workflow_dispatch' && inputs.client_checks == true
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:

CONTRIBUTING.md

@@ -71,10 +71,11 @@ Clean up worktrees and branches only after semantic review and integration are c
   isolated profiles, bounded deadlines, shared cleanup helpers, and a structured
   result. A manual diagnostic may locate a failure, but is not retained as pass
   evidence.
-- A Client-scoped pull request builds and smoke-tests all three platform
-  candidates before merge. A validated push to `main` uploads those short-lived
-  Server and Client candidates. Publishing a tag or GitHub Release remains an
-  explicit release decision rather than a side effect of every merge.
+- A validated push to `main` uploads a short-lived Server candidate. The three
+  platform Client candidates run only from an explicit manual workflow dispatch
+  with `client_checks=true`, because they are the expensive part of the matrix.
+  Publishing a tag or GitHub Release remains an explicit release decision rather
+  than a side effect of every merge.
 
 ## Pull Request Scope
 

docs/deployment.md

@@ -88,11 +88,11 @@ Retain the descriptor and successful deployment output as release metadata. Do
 not create a follow-up source commit solely to duplicate their revision, asset,
 or hashes.
 
-After `validate` succeeds on a push to `main`, CI packages this application
-release once and uses it to assemble Windows amd64, Linux amd64, and macOS arm64
-Client candidates on native runners. Each Client artifact contains one native
-archive and its SHA-256 file; Actions retains candidates for 14 days. This is
-automatic build output, not a tag, public GitHub Release, or deployment.
+After `validate` succeeds on a push to `main`, CI packages one short-lived
+Server application release. The three-platform Client matrix is an explicit
+manual workflow dispatch with `client_checks=true`; it consumes that same
+application artifact and retains the candidates for 14 days. Neither path is a
+tag, public GitHub Release, or deployment.
 
 Do not build or run the full repository check on a constrained production host.
 That host runs only the packaged binary and needs no Node, npm, or dependency

docs/todo.md

@@ -118,8 +118,9 @@ remain evidence gaps, not claims established by compilation or local loopback.
 15. **Unified release and update surface.** Build Client packages, Server
     runtime, future OCI images, and deployment bundles from one intentionally
     triggered immutable application release identified by its full commit SHA.
-    A validated `main` push now produces that application release and three
-    native-runner Client candidates with SHA-256 metadata. The default Client
+    A validated `main` push now produces that application release. An explicit
+    `client_checks=true` workflow dispatch produces the three native-runner
+    Client candidates with SHA-256 metadata. The default Client
     launcher now performs a non-blocking GitHub Releases check and the tracked
     deployment tree provides an operator-invoked read-only Server check. Formal
     GitHub Release publication, future OCI images, and deployment bundles remain