fix(ci): stop deleting the dev release — the tag can never come back

[castrojo]

What broke

Both flatpak workflows published the rolling dev bundle by deleting the latest-dev release and tag and re-creating them on every push to dev:

gh release delete latest-dev --yes --cleanup-tag 2>&1 || true
git push origin :refs/tags/latest-dev 2>&1 || true
gh release create latest-dev ... 2>/dev/null

With the immutable-release ruleset in effect that is a self-destruct. A tag that has ever carried a release is permanently banned from re-creation, so the delete succeeds and the create cannot:

HTTP 422: Validation Failed
pre_receive Repository rule violations found
Cannot create ref due to creations being restricted.

That happens for CI's github.token and for a maintainer PAT alike, and re-running the job does not help — I re-ran it, same failure. 2>/dev/null on the create meant the real error never reached the log; the job just reported release not found twice from the fallback path.

Current state: latest-dev no longer exists and cannot be recreated. The dev flatpak channel is down. dakota-iso's install-flatpaks.sh 404s on releases/download/latest-dev/org.bootcinstaller.Installer.Devel.flatpak and silently falls back to the upstream tuna-os bundle — so a live ISO quietly ships a different project's installer instead of failing loudly.

Triggered by merging #200. The landmine was already armed; that merge stepped on it.

Fix

• Rolling dev tag moves to dev-rolling (latest-dev is unusable forever — the ban is per tag name; arbitrary new tags create fine, verified).
• Publishing is now create-if-missing, then upload --clobber. No delete anywhere, in either workflow, so this cannot recur on the new tag.
• set -euo pipefail so a failure surfaces instead of being swallowed, and no more 2>/dev/null hiding the cause.
• Release notes now record the commit SHA and build time.

The comment already sitting in flatpak.yml warned that exactly this had happened to latest-stable. It was right, and the same pattern was left in place for latest-dev.

Companion change

dakota-iso must move its dev-channel URL to dev-rolling in the same window — filed alongside this. Until both land, installer_channel=dev ISO builds fall back to upstream.

Skill update

docs/skills/PITFALLS.md records the one-way-door rule and the two-repo coupling.

• I am using an agent and I take responsibility for this PR

Assisted-by: Claude Opus 5 via GitHub Copilot