[ioquatix]

Summary

• Adopt bake-gem-github ~> 0.7.0 for reviewed release PRs, validation, and publishing the exact merged release through RubyGems Trusted Publishing.
• Generate preparation, validation, and publishing workflows plus four native ruleset payloads; require stable Ruby matrix jobs, lint, coverage test runs, and Release validation.
• Remove legacy RubyGems certificate signing and the unused public certificate, preserving the gem's package file list. Retain release documentation hooks and add copyright refresh.
• Add maintenance agent-context support; update release instructions and notes. No version bump or publication is included.

Validation

• bundle exec bake test: 44 passed, 78 assertions.
• bundle exec rubocop: passed.
• Release validation against origin/main and unsigned gem build: passed.
• Local external tests could not complete because Safari automation sessions timed out; rely on fresh CI runners for downstream tests.

Existing CI failures

Test Coverage already fails on main (98.45%; CONNECT nonce compatibility and wrapper close/status paths). Documentation Coverage also already fails (10/74 public definitions documented), reproduced locally. Existing coverage workflows and thresholds are unchanged. The shared validate job name is deliberately omitted from the new required checks until these baselines are fixed; experimental Ruby jobs remain optional.

Setup

• Created the rubygems environment and verified its only deployment branch is main.
• A gem owner must run bundle exec bake gem:github:setup:publisher key=rubygems for RubyGems authentication/MFA.
• After merging and confirming selected checks, review bundle exec bake gem:github:setup:plan and run bundle exec bake gem:github:setup:apply to enable the four rulesets (two PR approvals with explicit administrator bypass; default branch and release-tag history protection).
• Actions already permits workflow-created PRs. No long-lived RubyGems token or certificate private key is needed.

The migration task could not reach local Ollama; the release hook was applied manually from the installed bake-modernize 0.66.0 template.