Claude/generate skill documentation f npo6 (#5)

* Add lightweight release-branch guard (CODEOWNERS + Actions)

- .github/CODEOWNERS routes review on every PR.
- .github/workflows/release-guard.yml rejects PRs into release that
  don't come from main, and rejects direct pushes whose tip isn't an
  ancestor of origin/main.
- .github/pull_request_template.md flags whether a PR targets release.

These are git-side guards; pair with the GitHub branch protection rule
for full enforcement (instructions in README).

* Switch branch policy: feature -> release -> main

- release is the integration/daily-release branch; accepts PRs from any branch.
- main is the stable publish branch; only accepts PRs from release.
- release-guard workflow renamed to branch-policy with four jobs covering
  push and PR events on both protected branches.
- READMEs (zh/en) and PR template updated to reflect the new flow and
  document the one-time gh api calls needed to enable UI-level branch
  protection.

* Prepare v1.0.0 release notes and changelog

- CHANGELOG.md following Keep a Changelog / SemVer
- .github/RELEASE_NOTES_v1.0.0.md as the body for the GitHub Release

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: Gutiz

.github/CODEOWNERS

@@ -0,0 +1,14 @@
+# Code owners — auto-requests review on PRs touching matching paths.
+# Listed users/teams must approve PRs into protected branches (see release-guard).
+#
+# Syntax: <pattern>  <owner1> <owner2> ...
+# Reference: https://docs.github.com/en/repositories/managing-your-repositories-settings-and-customizations/customizing-your-repository/about-code-owners
+
+*                       @Gutiz
+
+# Skill content & scripts
+/skills/                @Gutiz
+/skills/win-c-cleaner/  @Gutiz
+
+# CI / governance (changes here change how the repo is protected)
+/.github/               @Gutiz

.github/RELEASE_NOTES_v1.0.0.md

@@ -0,0 +1,49 @@
+# win-c-cleaner v1.0.0
+
+首个稳定版本 —— Windows 10/11 通用 C 盘清理 Claude Skill。
+
+## 亮点
+
+- **8 阶段流程**：从极低风险的临时文件清理 → 重复驱动 → OEM 预装包，按「风险低→收益大」顺序释放空间，预计回收 **25–35 GB**。
+- **Claude Skill 标准结构**：`SKILL.md` + YAML frontmatter，支持 Claude Code（CLI / Web / Desktop / VS Code）、Claude Agent SDK（Python / TypeScript）、Anthropic API Skills beta。
+- **安全设计**：管理员自检、Win10+ 自检、路径白名单、dry-run 默认、二次确认；Stage 8 强制非系统盘备份 + 大小校验。
+- **中英双语文档**：完整安装、使用、回滚说明。
+- **CI 守卫**：`branch-policy` 工作流防止意外破坏分支策略。
+
+## 快速安装
+
+```powershell
+# Claude Code（Windows）
+git clone https://github.com/Gutiz/win-c-cleaner.git
+$dst = "$env:USERPROFILE\.claude\skills\win-c-cleaner"
+New-Item -ItemType Directory -Path $dst -Force | Out-Null
+Copy-Item .\win-c-cleaner\skills\win-c-cleaner\* $dst -Recurse -Force
+```
+
+之后对 Claude 说 **「清理 C 盘」** 或 **「free up C drive」** 即可触发。
+
+## 直接运行（不通过 agent）
+
+```powershell
+# 管理员 PowerShell
+Set-ExecutionPolicy -Scope Process Bypass
+cd .\win-c-cleaner\skills\win-c-cleaner\scripts
+.\Get-DiskReport.ps1
+.\Clean-All.ps1
+```
+
+## 兼容性
+
+- Windows 10（10.0.19041+）/ Windows 11
+- PowerShell 5.1（系统自带）或 PowerShell 7+
+- 必须管理员身份运行
+- 可选：`winget`（Stage 7 优先用，缺失自动 fallback）
+
+## 已知限制
+
+- 阶段 5 UWP 应用迁移因 Windows API 限制需手动点击「移动」按钮，脚本会自动打开设置页。
+- 阶段 6 / 7 / 8 不会自动批处理多项，每项单独确认。
+
+## License
+
+[MIT](./LICENSE)

.github/pull_request_template.md

@@ -0,0 +1,14 @@
+## Summary
+
+<!-- 1-3 bullet points describing the change -->
+
+## Target branch
+
+- [ ] `release` — feature / fix / docs (default; merge from any feature branch)
+- [ ] `main` — release publish (source **must** be `release`, see branch-policy workflow)
+
+## Test plan
+
+- [ ] Stage scripts dry-run pass on Windows 10/11
+- [ ] `SKILL.md` frontmatter still parses
+- [ ] No new secrets / personal paths committed

.github/workflows/release-guard.yml

@@ -0,0 +1,83 @@
+name: branch-policy
+
+# Branch policy:
+#   - release: integration branch. Accepts PRs from any branch.
+#              Direct pushes blocked at the UI layer.
+#   - main:    publish branch. Accepts PRs ONLY from release.
+#              Direct pushes blocked at the UI layer.
+#
+# This workflow is the git-side enforcement. Pair with GitHub UI branch
+# protection rules (see README for the one-line gh command).
+
+on:
+  push:
+    branches: [main, release]
+  pull_request:
+    branches: [main, release]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  # PRs into main must come from release.
+  validate-main-pr-source:
+    if: github.event_name == 'pull_request' && github.base_ref == 'main'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require PR source = release
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+        run: |
+          if [ "$HEAD_REF" != "release" ]; then
+            echo "::error::PRs into 'main' must come from 'release' (got: $HEAD_REF)"
+            exit 1
+          fi
+          echo "OK: PR into main is from release"
+
+  # PRs into release: just announce; any source allowed.
+  announce-release-pr:
+    if: github.event_name == 'pull_request' && github.base_ref == 'release'
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "PR into release from ${{ github.head_ref }} — allowed."
+
+  # Direct pushes to release must be the result of a PR merge.
+  # We detect this by requiring the tip to be a merge commit OR the
+  # ancestor of an open PR head. Force-push / arbitrary push fails.
+  validate-release-push:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/release'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Require merge-commit tip (PR merge) or fast-forward from previous release
+        run: |
+          PARENTS=$(git rev-list --parents -n 1 HEAD | awk '{print NF-1}')
+          if [ "$PARENTS" -ge 2 ]; then
+            echo "OK: HEAD is a merge commit ($PARENTS parents). Likely a PR merge."
+            exit 0
+          fi
+          echo "::error::Direct non-merge push to 'release' is not allowed."
+          echo "::error::Open a PR into release instead."
+          exit 1
+
+  # Direct pushes to main must descend from origin/release.
+  validate-main-push:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Require push tip to descend from origin/release
+        run: |
+          git fetch origin release:refs/remotes/origin/release
+          if ! git merge-base --is-ancestor "${{ github.sha }}" origin/release \
+             && ! git merge-base --is-ancestor origin/release "${{ github.sha }}"; then
+            echo "::error::Commit ${{ github.sha }} is not on the release line."
+            echo "::error::main only accepts commits that came through release."
+            exit 1
+          fi
+          echo "OK: ${{ github.sha }} is reachable via release."

CHANGELOG.md

@@ -0,0 +1,39 @@
+# Changelog
+
+本项目遵循 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/)，版本号遵循 [SemVer](https://semver.org/lang/zh-CN/)。
+
+## [1.0.0] - 2026-05-14
+
+首发版本：Windows 10/11 通用 C 盘清理 Skill。
+
+### Added
+
+- `skills/win-c-cleaner/SKILL.md`：Skill 触发说明 + 行为规约 + 8 阶段手册。
+- 8 个独立 stage 脚本，可单独执行或通过 `Clean-All.ps1` 编排：
+  - Stage 1 `Invoke-Stage1-TempClean.ps1` —— 临时文件 / 缓存 / 回收站 / 崩溃转储（默认 dry-run）
+  - Stage 2 `Invoke-Stage2-HiberPagefile.ps1` —— `powercfg /h off` + `pagefile` 缩容
+  - Stage 3 `Invoke-Stage3-DismCleanup.ps1` —— DISM WinSxS 组件清理（可选 `/ResetBase`）
+  - Stage 4 `Invoke-Stage4-UwpBloat.ps1` —— UWP 垃圾应用卸载（含 `-AggressiveList`）
+  - Stage 5 `Invoke-Stage5-MoveApps.ps1` —— 大型 UWP 应用迁移到其他盘
+  - Stage 6 `Invoke-Stage6-DriverCleanup.ps1` + `Get-DuplicateDrivers.ps1` —— 重复驱动分批清理
+  - Stage 7 `Invoke-Stage7-OemBloat.ps1` —— OEM 预装软件（Dell/Lenovo/HP/ASUS/Acer/试用杀软）
+  - Stage 8 `Invoke-Stage8-RemovePpkg.ps1` —— OEM ppkg 强制备份后删除
+- 辅助脚本：`Get-DiskReport.ps1`、`Get-AppDataTopConsumers.ps1`、`_Common.ps1`。
+- 安全机制：管理员自检、Windows 10+ 自检、`Test-SafePath` 白名单、dry-run 默认、二次确认。
+- 中英双语 README（`README.md` / `README.en.md`）。
+- `.github/CODEOWNERS`、`.github/workflows/release-guard.yml`（branch-policy 工作流）、PR 模板。
+- 分支策略：`feat/* → PR → release → PR → main`，release 和 main 受保护，禁止直接 push 与 force push。
+
+### Security
+
+- 删除操作均经过路径白名单校验，越界路径自动拒绝。
+- Stage 3 `/ResetBase`、Stage 6 删驱动、Stage 8 删 ppkg 均要求显式参数 + 二次确认。
+- Stage 8 强制 `-BackupDir` 指向非系统盘，复制+大小校验通过后才删除原文件。
+
+### Notes
+
+- 预计在 Win10/11 上典型可释放 **25–35 GB** 空间。
+- 阶段 2/3/6 完整生效需重启。
+- 阶段 5/8 推荐有第二块盘（D:/E:/移动盘）。
+
+[1.0.0]: https://github.com/Gutiz/win-c-cleaner/releases/tag/v1.0.0

README.en.md

@@ -236,15 +236,60 @@ It will not fire on macOS or Linux sessions.
 
 ---
 
-## Branches
+## Branch policy
 
-| Branch | Purpose |
-|--------|---------|
-| `main` | Mainline development |
-| `release` | Daily release branch — protected, deployment artifacts cut from here |
-| `claude/*` | Claude-generated feature branches |
+| Branch | Role | Write rules |
+|--------|------|-------------|
+| `release` | **Daily integration / release branch** (protected) | No direct push; accepts PRs from any feature branch |
+| `main` | **Stable publish branch** (protected) | No direct push; **only accepts PRs from `release`** |
+| `claude/*`, `feat/*`, `fix/*` | Feature / fix branches | Free push; merged via PR into `release` |
 
-Pull requests should target `main`. Release rotations cherry-pick or fast-forward from `main` into `release`.
+Flow:
+
+```
+feat/foo ──► PR ──► release ──► PR ──► main
+fix/bar  ──► PR ──┘
+```
+
+`.github/workflows/release-guard.yml` enforces git-side checks:
+- PR into `main`: requires `head_ref == release` or fails
+- Push to `main`: requires the tip to be reachable from release
+- Push to `release`: requires a merge-commit tip (PR-merge artifact)
+
+True UI-level blocking still needs a one-time branch protection setup
+(see "Set up branch protection" below).
+
+### Set up branch protection (one-time)
+
+Install `gh` locally, run `gh auth login`, then:
+
+```bash
+# release: no direct push, PRs required
+gh api -X PUT repos/Gutiz/win-c-cleaner/branches/release/protection \
+  -F required_pull_request_reviews.required_approving_review_count=1 \
+  -F required_pull_request_reviews.dismiss_stale_reviews=true \
+  -F required_linear_history=true \
+  -F allow_force_pushes=false \
+  -F allow_deletions=false \
+  -F enforce_admins=true \
+  -F required_status_checks.strict=true \
+  -F 'required_status_checks.contexts[]=branch-policy / announce-release-pr' \
+  -F 'required_status_checks.contexts[]=branch-policy / validate-release-push' \
+  -F restrictions=
+
+# main: no direct push, PRs required, PR source must be release
+gh api -X PUT repos/Gutiz/win-c-cleaner/branches/main/protection \
+  -F required_pull_request_reviews.required_approving_review_count=1 \
+  -F required_pull_request_reviews.dismiss_stale_reviews=true \
+  -F required_linear_history=true \
+  -F allow_force_pushes=false \
+  -F allow_deletions=false \
+  -F enforce_admins=true \
+  -F required_status_checks.strict=true \
+  -F 'required_status_checks.contexts[]=branch-policy / validate-main-pr-source' \
+  -F 'required_status_checks.contexts[]=branch-policy / validate-main-push' \
+  -F restrictions=
+```
 
 ---
 

README.md

@@ -237,13 +237,57 @@ Skill 通过 `SKILL.md` frontmatter 中的描述自动匹配下列触发词：
 
 ## 分支策略
 
-| 分支 | 用途 |
-|------|------|
-| `main` | 主线开发 |
-| `release` | 日常发布分支（受保护），构建/发布产物从这里切 |
-| `claude/*` | Claude 生成的功能分支 |
+| 分支 | 用途 | 写入规则 |
+|------|------|---------|
+| `release` | **日常集成 / 发布分支**（受保护） | 不可直接 push；接收来自任意 feature 分支的 PR |
+| `main` | **发布稳定分支**（受保护） | 不可直接 push；**只接收来自 `release` 的 PR** |
+| `claude/*`、`feat/*`、`fix/*` | 功能 / 修复分支 | 自由 push，通过 PR 合入 `release` |
 
-Pull Request 默认合到 `main`，发布时从 `main` 合入 / fast-forward 到 `release`。
+提交流向：
+
+```
+feat/foo ──► PR ──► release ──► PR ──► main
+fix/bar  ──► PR ──┘
+```
+
+`.github/workflows/release-guard.yml` 已经在 git 层做基本检查：
+- PR 进入 `main`：CI 校验 `head_ref == release`，否则 fail
+- Push 到 `main`：CI 校验 tip 必须在 release 历史上
+- Push 到 `release`：CI 校验 tip 必须是 merge commit（PR 合并产物）
+
+UI 层的强制阻止还需要一次性的 Branch Protection 设置（见下文「设置分支保护」）。
+
+### 设置分支保护（一次性）
+
+本机装好 `gh` 并 `gh auth login` 后，跑：
+
+```bash
+# release：禁止直接 push，必须 PR
+gh api -X PUT repos/Gutiz/win-c-cleaner/branches/release/protection \
+  -F required_pull_request_reviews.required_approving_review_count=1 \
+  -F required_pull_request_reviews.dismiss_stale_reviews=true \
+  -F required_linear_history=true \
+  -F allow_force_pushes=false \
+  -F allow_deletions=false \
+  -F enforce_admins=true \
+  -F required_status_checks.strict=true \
+  -F 'required_status_checks.contexts[]=branch-policy / announce-release-pr' \
+  -F 'required_status_checks.contexts[]=branch-policy / validate-release-push' \
+  -F restrictions=
+
+# main：禁止直接 push，必须 PR，且 PR 来源只能是 release
+gh api -X PUT repos/Gutiz/win-c-cleaner/branches/main/protection \
+  -F required_pull_request_reviews.required_approving_review_count=1 \
+  -F required_pull_request_reviews.dismiss_stale_reviews=true \
+  -F required_linear_history=true \
+  -F allow_force_pushes=false \
+  -F allow_deletions=false \
+  -F enforce_admins=true \
+  -F required_status_checks.strict=true \
+  -F 'required_status_checks.contexts[]=branch-policy / validate-main-pr-source' \
+  -F 'required_status_checks.contexts[]=branch-policy / validate-main-push' \
+  -F restrictions=
+```
 
 ---