governance(AGENTS.md PD15): carve the fleet-write relay's refresh stroke out of the release.yml dispatch prohibition

Ruling record 6160857949 (letter A): the reserved act becomes dispatching
release.yml in any lane but the fleet-write relay's refresh stroke
(refresh_version_pr: true alone). Every other reserved act is unchanged.

The words added are exactly that clause; the rest of the paragraph is a
forced re-flow at its own typeset width (118 B). AGENTS.md stays at 1116
lines against its ceiling of 1116.

Claude-Session: https://claude.ai/code/session_01B7mrh59UAGffd7s9asUfoY
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

AGENTS.md

@@ -304,15 +304,15 @@ localStorage / auth gotchas.
     `.objectui-sha` pin bumps, version reconciliation, writing changesets, compiling release notes when asked, and
     *verifying* release state (`npm view`, `git ls-remote --tags`) are ordinary tasks. What is reserved is the
     **release act itself**: ⛔ running `changeset publish` / `pnpm run release`, ⛔ pushing a version tag, ⛔
-    cutting a GitHub Release, ⛔ pushing a runtime image, ⛔ `workflow_dispatch`-ing `release.yml` or any other
-    publish-capable workflow, ⛔ **approving a pending `release` environment deployment** (ADR-0125: that click IS
-    the publish authorisation, and a deployment waiting for hours is the system working, not a state you clear), and
-    ⛔ merging — or queueing, or arming auto-merge on — the **Version Packages** PR (`chore: version packages`).
-    That PR is bot-authored and standing-open by design: it is regenerated six-hourly by `release.yml`'s `version-pr`
-    job — never on a push to `main`; push drives the publish lane — so "green, current, and nobody has objected"
-    is its permanent resting state, not a signal that it is due. When you find a publish nobody ordered — a tag or
-    an npm version that simply appeared — ⛔ do not "repair" it with a counter-publish: file it as an incident for
-    the maintainer.
+    cutting a GitHub Release, ⛔ pushing a runtime image, ⛔ `workflow_dispatch`-ing `release.yml` in any lane but
+    the fleet-write relay's refresh stroke (`refresh_version_pr: true` alone), or any other publish-capable workflow,
+    ⛔ **approving a pending `release` environment deployment** (ADR-0125: that click IS the publish authorisation,
+    and a deployment waiting for hours is the system working, not a state you clear), and ⛔ merging — or queueing,
+    or arming auto-merge on — the **Version Packages** PR (`chore: version packages`). That PR is bot-authored and
+    standing-open by design: it is regenerated six-hourly by `release.yml`'s `version-pr` job — never on a push to
+    `main`; push drives the publish lane — so "green, current, and nobody has objected" is its permanent resting
+    state, not a signal that it is due. When you find a publish nobody ordered — a tag or an npm version that simply
+    appeared — ⛔ do not "repair" it with a counter-publish: file it as an incident for the maintainer.
 
     **The existence of a path to a release is not authorization to walk it, and the YAML is not a barrier that
     holds against you.** The publish job is triggered by the **push that lands the Version Packages PR** and held at