Build and release xcsh

The repository is a Bun workspace with a Rust native layer. Follow AGENTS.md, CONTRIBUTING.md, and DEVELOPING.md before editing.

How do I prepare a contribution?

Create a detailed issue, branch from current origin/main in an isolated worktree, and run bun install --frozen-lockfile. Write a failing focused test for code behavior, implement the smallest fix, then run the package and repository checks.

Which checks matter before a pull request?

Run each gate before you open the pull request:

1. bun run check for formatting, linting, and types.
2. bun run test for the package suites.
3. python3 scripts/check_docs_quality.py when an English MDX file changed.
4. The secret and personally identifiable information (PII) scans.
5. The repository review gate.

Inspect the complete diff, then deliver only through a linked pull request.

How are releases produced?

Protected workflows build and verify binaries, npm packages, Homebrew artifacts, containers, and downstream apt packaging. Contributors do not publish those channels manually.

Before pushing, confirm git diff --check, inspect every staged path, and run the narrowest package test that exercises the change. A documentation-only change does not authorize a release. A release workflow owns versioning, signing, publication, and provenance checks; a contributor-owned command stops at the pull request boundary. If a gate fails, reproduce it from the same commit instead of bypassing the gate or substituting an older artifact.