Gate release tagging behind a Windows smoke-test approval

[dominikschubert]

Why

DEVX-1042 asks for a guardrail so Windows is tested before every release. CI cannot cover it: GitHub windows-latest runners can't run Linux containers, creack/pty has no Windows support, and only the ubuntu shards run real Docker tests (see #480 discussion).

Today both release paths tag with zero human checkpoints. This PR adds one.

What

• automated-release.yml and create-release-tag.yml: the tag job is bound to the release GitHub environment and waits for a required reviewer.
• Run summary before the gate: Determine version bump / new Resolve release ref job print the exact commit to smoke-test. A reviewer can read it while the tag job is still waiting (a summary inside the gated job would only appear after approval).
• SHA pinning: the tag job checks out the resolved SHA, not main/release_ref. Otherwise a multi-day approval wait could tag a newer, untested commit.
• docs/RELEASING.md: new "Windows smoke test" section with the checklist (start, socket mount, logs, Lambda invoke, stop) and the approval flow.

Environment protection rules work on the free/team plans only because the repo is public. If it ever goes private they are silently ignored.

One-time setup (repo admin, before merge)

Do this before merging: if the environment doesn't exist when the first gated run starts, GitHub auto-creates it without protection rules and the run tags without approval.

Reviewers: @dominikschubert (primary), @anisaoshafi, @joe4dev, @skyrpex . prevent_self_review stays false because the person dispatching a manual release is usually the one who ran the smoke test.

• Restrict deployments to main:

  gh api -X POST repos/localstack/lstk/environments/release/deployment-branch-policies -f name=main -f type=branch

• Verify: gh api repos/localstack/lstk/environments/release shows can_admins_bypass: false, 3 reviewers, 1 branch policy.
• Merge this PR.
• First gated release: run Create Release Tag, confirm the run summary shows the SHA, do the smoke test, approve.

Verification

• actionlint passes on both workflows (shellcheck integration disabled locally).
• git diff --check clean.
• Cannot be dry-run before the environment exists; the first manual release is the live test.

Out of scope / follow-ups

• A scripts/windows-smoke.ps1 helper to standardize the manual step (under discussion).
• Automate a Windows Server smoke on EC2 via scripts/ec2-sandbox.sh as a pre-tag job.
• Hybrid cadence: Win11 + Docker Desktop per release, Windows Server more often.
• Update DEVX-1042 once this is in.

🤖 Generated with Claude Code