docs/ci: drop stale local-precommit/release.sh references — CI is the only gate

.github/workflows/release.yml

@@ -29,14 +29,14 @@ jobs:
 
   # Tests run as a PARALLEL TRIPWIRE: they fail the run if they fail, but the
   # release job does NOT `needs:` this job. The tag decision was already gated by
-  # the local precommit (same MSRV, same commit).
+  # CI (ci.yml on dev, then a green qa.yml on the same commit).
   #
   # Cargo.lock is now committed (issue #15), but --locked is still omitted: on
   # the runner the libfreemkv dep resolves from crates.io, not the local path
   # patch, which --locked can't reconcile. Its
   # libfreemkv dep resolves from crates.io (the dev .cargo/config.toml patch is
   # gitignored and absent on the runner), so libfreemkv must already be published
-  # at this version — the release script enforces that ordering before tagging.
+  # at this version — release-orchestrate.yml enforces that ordering before tagging.
   test:
     needs: verify
     runs-on: ubuntu-latest
@@ -51,12 +51,10 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - run: cargo test
 
-  # NOTE: the crates.io publish is driven by the maintainer's release tooling
-  # from local credentials, not from CI — this repo has no CARGO_REGISTRY_TOKEN
-  # secret. release.sh runs `cargo publish --no-verify` locally. CI here only
-  # verifies the version/tag match, runs tests (tripwire), and cuts the GitHub
-  # Release. The binaries git-tag-pin keysources, so they don't wait on the
-  # crates.io publish — it serves external consumers in parallel.
+  # NOTE: there is no crates.io publish — keysources is `publish = false` and
+  # git-tag-only. Consumers git-tag-pin it via a committed [patch.crates-io], so
+  # the git tag itself is the release artifact. CI here only verifies the
+  # version/tag match, runs tests (tripwire), and cuts the GitHub Release.
 
   release:
     # Only needs `verify`; the GitHub Release is cut as soon as the version