[ioquatix]

Summary

• Adopt bake-gem-github ~> 0.7.0 for reviewed release PRs, validation, and publishing the exact merged release through RubyGems Trusted Publishing.
• Generate preparation, validation, and publishing workflows plus four native ruleset payloads; require stable Ruby matrix jobs, lint, coverage test runs, and Release validation.
• Remove legacy RubyGems certificate signing and the unused public certificate, preserving the gem's package file list. Retain release documentation hooks and add copyright refresh.
• Update release instructions and notes. No version bump or publication is included.

Validation

• bundle exec bake test: 96 passed, 161 assertions.
• bundle exec rubocop: passed.
• bundle exec bake decode:index:coverage lib: 132/132 documented.
• Release validation against origin/main and unsigned gem build: passed.
• Local external tests blocked by an existing cached downstream checkout with missing historical dependencies; CI runs from fresh checkouts.

Existing CI failures

Test Coverage already fails on main (98.91%; fallback masking implementation and unsupported-message error path). Existing coverage workflows and thresholds are unchanged. The shared validate job name is deliberately omitted from the new required checks until the baseline is fixed; experimental Ruby jobs remain optional.

Setup

• Created the rubygems environment and verified its only deployment branch is main.
• A gem owner must run bundle exec bake gem:github:setup:publisher key=rubygems for RubyGems authentication/MFA.
• After merging and confirming selected checks, review bundle exec bake gem:github:setup:plan and run bundle exec bake gem:github:setup:apply to enable the four rulesets (two PR approvals with explicit administrator bypass; default branch and release-tag history protection).
• Actions already permits workflow-created PRs. No long-lived RubyGems token or certificate private key is needed.

The migration task could not reach local Ollama; the release hook was applied manually from the installed bake-modernize 0.66.0 template.