chore: update bot name and email in workflows and documentation

Author: alxshelepenok

.github/workflows/release.yml

@@ -453,8 +453,8 @@ jobs:
         if: inputs.mode != 'dry-run'
         run: |
           set -euo pipefail
-          git config user.name "grove-release[bot]"
-          git config user.email "grove-release[bot]@users.noreply.github.com"
+          git config user.name "grove-compass[bot]"
+          git config user.email "4816812+grove-compass[bot]@users.noreply.github.com"
           git add manifest.json manifest.json.sig docs/security/artifacts/ install.sh.sig install.ps1.sig
           if git diff --cached --quiet; then
             echo "nothing to commit"

.github/workflows/rust-tests.yml

@@ -72,8 +72,8 @@ jobs:
           TOTAL: ${{ steps.count.outputs.total }}
           CORPUS: ${{ steps.count.outputs.corpus }}
         run: |
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git config user.name "github-actions[bot]"
+          git config user.email "4816812+grove-compass[bot]@users.noreply.github.com"
+          git config user.name "grove-compass[bot]"
           git fetch origin badges 2>/dev/null || true
           if git rev-parse --verify origin/badges >/dev/null 2>&1; then
             git checkout -B badges origin/badges

docs/architecture/release-distribution.md

@@ -90,7 +90,7 @@ The signature covers the exact bytes of `manifest.json`; installers verify befor
 
 Releases are tag-driven: the maintainer pushes `vX.Y.Z`, then dispatches `release` mode with that version. Version tags are the only source of release numbering; the workflow never creates tags.
 
-After publishing, the `Commit transparency log` step (skipped for dry-run) stages `manifest.json`, `manifest.json.sig`, `install.sh.sig`, `install.ps1.sig`, and `docs/security/artifacts/`, commits as `grove-release[bot]`, and pushes to `main`. When branch protection rejects the direct push, the step pushes to `release/v<version>` (or `release/<mode>-<timestamp>` when no version applies) and opens a PR to `main` titled `release: transparency artifacts (...)`. This keeps the root manifest that installers fetch from `raw.githubusercontent.com/.../main` in sync with the latest release.
+After publishing, the `Commit transparency log` step (skipped for dry-run) stages `manifest.json`, `manifest.json.sig`, `install.sh.sig`, `install.ps1.sig`, and `docs/security/artifacts/`, commits as `grove-compass[bot]`, and pushes to `main`. When branch protection rejects the direct push, the step pushes to `release/v<version>` (or `release/<mode>-<timestamp>` when no version applies) and opens a PR to `main` titled `release: transparency artifacts (...)`. This keeps the root manifest that installers fetch from `raw.githubusercontent.com/.../main` in sync with the latest release.
 
 ## Post-release smoke test
 

docs/security/runbooks/incident-response.md

@@ -56,7 +56,7 @@ A false-alarm review can follow; do NOT postpone the 1-hour actions pending inve
    gh release list --limit 30
    gh release view vX.Y.Z --json tagName,assets,createdAt
    ```
-   Diff each `manifest.json` revision against its predecessor: unexpected sequence jumps, changed artifact hashes or URLs, and commits outside the `grove-release[bot]` commit-back flow mark the compromised window.
+   Diff each `manifest.json` revision against its predecessor: unexpected sequence jumps, changed artifact hashes or URLs, and commits outside the `grove-compass[bot]` commit-back flow mark the compromised window.
 2. For every release inside that window, re-verify the published manifest and artifacts with `bin/verify.sh` and the checks in `release-security-checks.md`; flag any release whose assets fail verification for deletion.
 3. Notify users via a GitHub Security Advisory on the repository, following the disclosure process in `SECURITY.md`: describe the compromise window, the new key fingerprint, the new `MINIMUM_SEQUENCE`, and instruct users to reinstall with the current `install.sh`/`install.ps1`.