fix(release): pin reusable workflow to published commit (#18)

Author: OgeonX-Ai

.github/workflows/release-please-reusable.yml

@@ -1,11 +1,6 @@
 name: Release Please (reusable)
 on:
   workflow_call:
-    inputs:
-      release-type:
-        description: "release-please release-type strategy"
-        type: string
-        default: simple
 jobs:
   release-please:
     runs-on: ubuntu-latest
@@ -17,6 +12,5 @@ jobs:
     steps:
       - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:
-          release-type: ${{ inputs.release-type }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json

.github/workflows/release-please.yml

@@ -9,4 +9,4 @@ jobs:
       contents: write
       pull-requests: write
       issues: write
-    uses: Coding-Autopilot-System/.github/.github/workflows/release-please-reusable.yml@f288e5e3b67b29a2c08880b76da7b852f4a132d0
+    uses: ./.github/workflows/release-please-reusable.yml

docs/RELEASE_POLICY.md

@@ -41,10 +41,12 @@ safety boundaries.
    and its default flow opens a review-gated "release PR" rather than tagging
    directly on every merge, which fits the existing two-party-review governance
    instead of fighting it.
-2. **Uniform `release-type: simple` across all 13 repos**, regardless of language
+2. **Uniform manifest `release-type: simple` across all 13 repos**, regardless of language
    (C#, Python, Node, PowerShell, docs-only). `simple` only manages a
    `CHANGELOG.md` + version manifest and never mutates a language-specific manifest
-   file, avoiding 13 different per-language configurations.
+   file, avoiding 13 different per-language configurations. The reusable action
+   deliberately does not pass a `release-type` input, because release-please's
+   manifest mode derives the strategy from each repository's config file.
 3. **Each repo keeps its own independent SemVer line** — not synced to the CAS
    portfolio milestone number (e.g. v1.5). gsd-orchestrator (already at v4.0.0) and
    cas-contracts (already at v1.1.1) already prove per-repo versioning is
@@ -65,4 +67,6 @@ safety boundaries.
    itself SHA-pinned, per the existing Phase 31 org action-pinning policy. Bumping
    the pinned release-please-action version later requires a deliberate, reviewed
    SHA update in each caller — the same accepted maintenance tradeoff Phase 31
-   already established for direct action pins.
+   already established for direct action pins. This repository calls its own
+   reusable workflow with a relative path so that the caller and implementation
+   are evaluated from the same reviewed commit.