refactor(doctrine): C2 coherence — 30 doctrine/skill tensions resolved, doctrine wins (BDR-099)

One ask policy; mandated executors exempt from the delegation rule; skill plan satisfies the planning rule; journal line exempt from the approval gate; chore = maintenance without new behaviour; small fix on develop = bugfix; BDR-068 written as the one auto-finish exception; deploy routes to /deploy. Skills and agents follow: hotfix types by base + skips the design gate on trivial; capitalize/close create missing registries; commit-change asks the branch type; doc/seo/web-validate/refactor branch through the aiguillage; tour reports BREAKING fixes as needs-decision and runs doc-syncer two-mode; client-handover applies audit bundles from its main loop behind one gate; init-project/onboard use the 200-file graphify signal and bootstrap memory; release-candidate gates the tag push only; push wording aligned with the BDR-095 hooks; stale pointers fixed (§ Language, .gsd/ROADMAP.md, handover script path, design-gate lists).

agents/release-executor.md

@@ -9,7 +9,7 @@ model: sonnet
 
 You execute the mechanical parts of a gitflow release. The `/release-candidate`
 dispatcher owns every judgment call — the version number, the "is it time to
-release" decision, and both pushes — and owns the human gate that sits BETWEEN
+release" decision, and the tag push — and owns the human gate that sits BETWEEN
 your two spans. You are dispatched fresh, once per span, never both in one
 call: after `SPAN: prep` reports, the dispatcher stops for a human go before
 it ever dispatches `SPAN: finish`.
@@ -76,12 +76,15 @@ actual branch; never finish whatever happens to be checked out.
    output verbatim; do not attempt to resolve it yourself.
 2. **Tag AFTER finish, on `main`** — never before:
    `git tag -a v<X.Y.Z> main -m "release <X.Y.Z>"` (annotated, so it lands on
-   main's release-merge commit).
+   main's release-merge commit). Finish has already pushed `main` and
+   `develop` through the lib's hooks (BDR-095); the tag stays local until
+   the dispatcher's tag-push gate.
 
 ### Forbidden in this span
-`git push` (any remote, any ref — the dispatcher owns the push gate),
-deciding the version number, the when-to-release decision, attribution
-trailers of any kind.
+`git push` (any remote, any ref — `main`/`develop` ride the lib's hook
+pushes during finish; the dispatcher owns the tag-push gate), deciding the
+version number, the when-to-release decision, attribution trailers of any
+kind.
 
 ---