[Andreas-Garcia]

Summary

Release v5.1.0 of github-workflows: bump VERSION 5.0.1 → 5.1.0 and move [Unreleased] into ## [5.1.0] - 2026-11-11. Delivers the lag-tolerant create-tag fix (#35, #36) plus the CI-owned release features merged since v5.0.1.

Changes

• VERSION: 5.0.1 → 5.1.0.
• CHANGELOG.md: [Unreleased] entries moved under [5.1.0]; [Unreleased] left empty.
• Release content (v5.0.1..main): feat(release): validate pushes and create immutable App tags #30–ci(release): pin release workflows to the lag-tolerant commit #36 (App-based atomic tagging, shared publisher provenance and recovery, CI-owned releases for this repo, fenced-changelog fixes, tag read-lag tolerance).

Test plan

• Version/changelog consistency checked by hand: VERSION matches a nonempty ## [5.1.0] section, minor bump justified by the Added/Changed entries.
• Branch has no commits behind origin/main; tag v5.1.0 does not exist on origin.
• Release content was tested in its own PRs (fix(release): tolerate tag read lag and pin helpers to the workflow commit #35 sandbox run: tag created, Release OK).

Screenshots

N/A

Risk

Intent release, depth standard. The independent reviewer subagent was unavailable (usage limit), so the review was done in the principal session; limitation disclosed. CI creates the tag v5.1.0 on the merge commit and publishes the GitHub Release; consumers stay pinned by SHA, so nothing changes for them until they repin.

How to revert

Do not move or delete the tag. If needed, fix forward with a patch release; a revert of this PR before merge simply drops the bump.

Deployment notes

No migration. After merge, follow the main-push tag workflow run and verify tag v5.1.0 points at the merge commit and the GitHub Release exists. Target branch: main (GitHub flow, squash).

🤖 Generated with Claude Code