refactor(release): collapse to 2-PR shape + delete dead rotation slice (#835)

## Summary

Atomic deletion of the rotation slice and collapse of `ship-release.yml`
from 3 PRs (Infra + Conductor + Docs) to 2 PRs (Conductor + Docs).

**This PR unblocks the 8.1.1 ship.** Today, `ship-release.yml`'s
preflight
either blocks on PR #760's unmergeable state or, if forced, would merge
patches that resurrect the `docker/openemr/*` tree deleted by the docker
migration. Collapsing to 2-PR removes the Infra slot entirely; PR #760
becomes a dangling OPEN PR (close manually as cosmetic cleanup after
this lands).

## Why now

The docker-pipeline migration to `openemr/openemr` (#790, completed
2026-06-20) moved all of rotation's live targets out of this repo:

- `versions.yml`'s 13 entries all point at paths that no longer exist
  (`docker/openemr/**`, `utilities/container_benchmarking/**`, two
  deleted workflows)
- `SlotRotator`'s last run on 2026-06-10 left
  `release-rotation/auto` (#760) frozen with patches that edit files
  which now return 404 on master
- Subsequent `release-rotation.yml` runs no-op because the diff against
  the existing branch is empty

The Infra PR slot exists in `PullRequestTarget::forRelease()` + the
ship-release orchestrator but the underlying machinery is dead.

## Coordinated companion

**openemr/openemr#12631** updates the cross-repo docs
(`RELEASE_PROCESS.md` + `release-automation-plan.md`) to the 2-PR shape.
**Recommended landing order: #12631 first** (docs match the imminent
code state), then this PR (code catches up to the new docs).

## Deleted (16 files, ~2625 LOC)

- `tools/release/versions.yml` (registry pointing at deleted paths)
- `tools/release/src/SlotRotator.php`, `SlotAssignmentParser.php`,
  `SlotRotationResult.php`, `RotationPrPublisher.php`,
  `VersionsRegistryLinter.php`, `LintIssue.php`
- `tools/release/bin/rotate.php`, `lint-versions.php`,
  `open-rotation-pr.php`, `derive-slots-from-dispatch.php`
- `tools/release/tests/SlotRotatorTest.php`,
  `SlotAssignmentParserTest.php`, `VersionsRegistryLinterTest.php`,
  `RotationPrPublisherTest.php`
- `.github/workflows/release-rotation.yml`
- `docs/release-automation-plan.md` (devops-side rotation slice pre-
  implementation design doc — misleading once the rotation code is
  gone)

## Modified (13 files)

- **`PullRequestTarget.php`** — `forRelease()` drops the Infra row;
  Conductor `mergeOrder: 2 → 1`, Docs `mergeOrder: 3 → 2`; docblock
  updated
- **`RoleLabel.php`** — drop `Infra` enum case; docblock "three" → "two"
- **`ShipReleaseOrchestrator.php`** — 3 docblocks updated; **no
  runtime code changes** (orchestrator already used only
  `RoleLabel::Conductor` and `RoleLabel::Docs` in its logic)
- **`PullRequestTargetTest.php`** — test renamed + rewritten for
  2-target shape
- **`ShipReleaseOrchestratorTest.php`** — full rewrite: dropped
  `INFRA_REPO`/`INFRA_BRANCH` constants, removed all infra fixture
  setup, renumbered step assertions, renamed test methods, dropped
  `testInfraAlreadyMergedSkipsThenContinues` (no 2-PR analog;
  `SKIPPED_ALREADY_MERGED` coverage preserved by
  `testConductorAlreadyMergedRefetchesDocsBeforeMerging`)
- **`ShipReleaseSummaryRendererTest.php`** — dropped Infra fixture
  entries; first two tests now exercise Conductor rows
- **`Taskfile.yml`** — dropped 5 tasks (`release:rotate`,
  `release:lint-versions`, `release:open-rotation-pr`,
  `release:derive-slots-from-dispatch`, `release:push-rotation-branch`);
  `release:ship` desc updated
- **`bin/ship-release.php`** — header docblock + Symfony
  `setDescription` updated
- **`README.md`** — dropped `versions.yml` row from the directory-tree
- **`AppPermissionProbe.php`** — comment updated to drop the
  rotation-specific motivation (workflows:write probe still needed for
  build-release / release-announcements / ship-release)
- **`release-permissions-check.yml`** — header comment dropped the
  "only what rotation needs" framing
- **`ship-release.yml`** — header comment updated for 2-PR shape

## What's NOT touched (intentional)

- The cross-repo docs in `openemr/openemr` (covered by #12631)
- Anything outside the release-mechanism + permissions-check surfaces
  (kubernetes, packages, raspberrypi, mariadb-backup-manager, etc.)

## Test plan

- [ ] CI passes (PHPUnit will exercise the test rewrites)
- [ ] After both #12631 and this PR land:
  - Close PR #760 manually as cosmetic cleanup
- `gh workflow run ship-release.yml --repo openemr/openemr-devops -f
version=8.1.1 -f rel_branch=rel-810` proceeds through preflight (no
Infra blocker)
- Conductor PR (openemr/openemr#12377) merges first, fires the tag +
cascade
  - Docs PR on website-openemr merges next

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Release shipping now follows a simpler two-PR flow (Conductor → Docs)
with updated merge-order guidance.
* **Bug Fixes**
* Updated release workflow permission/probing descriptions and narrowed
the PR write scope to the two involved PRs.
* **Documentation**
* Removed outdated release automation plan content; updated release
tooling docs to reflect the new flow.
* **Chores**
* Retired release-rotation/version-linting workflows and scripts,
removed related tooling/tests, and cleared the release tooling registry
configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Author: bradymiller

.github/workflows/release-permissions-check.yml

@@ -2,8 +2,9 @@ name: Release Permissions Check
 
 # Manual probe of the release App's installed permissions on this repo.
 # Mints an App token from the RELEASE_APP_CLIENT_ID org variable +
-# RELEASE_APP_PRIVATE_KEY org secret and
-# exercises only what tools/release/ rotation needs (per docs/release-automation-plan.md).
+# RELEASE_APP_PRIVATE_KEY org secret and exercises what the
+# release-mechanism workflows in tools/release/ need (build-release,
+# release-announcements, ship-release, dispatch fan-out).
 # Run after installing the App and after secrets rotations.
 
 on:

.github/workflows/release-rotation.yml

@@ -1,10 +1,10 @@
 name: Ship Release
 
-# Manually-triggered orchestration for the three-PR release flow (#705):
-# merges infra → conductor → docs in strict order, skipping any already merged
+# Manually-triggered orchestration for the two-PR release flow (#705):
+# merges conductor → docs in strict order, skipping any already merged
 # (so the same trigger handles partial-merge recovery), and refusing to merge
 # anything if any unmerged PR is not ready. Mints one App token with PR-write
-# on all three repos and posts a release/ship-approved commit status on each
+# on both repos and posts a release/ship-approved commit status on each
 # PR head before merging it (so branch protection can require it later).
 
 on:

.github/workflows/ship-release.yml

@@ -14,8 +14,7 @@ tools/release/
 ├── contracts/   JSON schemas vendored across consumer repos
 ├── scripts/     Operational shell probes (App-token sanity checks etc.)
 ├── templates/   PR body / changelog Twig templates
-├── Taskfile.yml Glue between workflows and the PHP CLIs (`task release:*`)
-└── versions.yml The 3-slot rotation registry (current/next/dev)
+└── Taskfile.yml Glue between workflows and the PHP CLIs (`task release:*`)
 ```
 
 Workflow steps in `.github/workflows/` are deliberately thin: mint App token,