Releases were cut by hand-pushing a tag. Now each push to main turns any .changeset/ files into a release PR, or a new round of the open one, and merging it bumps the version in go.mod's module comment, writes CHANGELOG.md, and has CI push the tag that release.yml builds from.
Tangled v1 PRs are an org.tangled.track.ticket plus submitPatch rounds on the knot, so hack/release.sh writes them with service-auth tokens from the owner's PDS, and pushes over HTTPS with a receivePack token. The app password secret covers pushing, PRs and artifacts, with no SSH key. release.yml's attach step moves into the same script.