Token file: /tmp/passepartout-release-approved
Hook at: scripts/pre-push-release-guard
Documented in: docs/CONTRIBUTING.org
This is a hard enforcement of the AGENTS.md release-permission rule.
I physically cannot push a tag unless the user creates the token file.
Token is consumed (deleted) on first successful push.
