[AAASM-3503] 🔧 (ci): SDK release operator-dispatch only (no auto-publish on core release)

[Chisanan232]

What changed

Removes the repository_dispatch: agent-assembly-release-published trigger from release-python.yml, making it operator-dispatch-only (workflow_dispatch). The now-unreachable repository_dispatch resolve branch and its client_payload references are removed, and the docs publish-release-tag handoff is repointed from client_payload.release_tag to the resolve job's computed release_tag output (so it now works on the operator path).

Why

The core agent-assembly release.yml notify-downstream step fires this repository_dispatch on every core publish. The resolve job derived pypi_version from the core tag (tag_to_pep440) and forced dry_run=false — a real publish. Because the Python SDK has an independent version iterator and is at/ahead of the core-derived version, PyPI rejects the duplicate and the publish step fails on every core release.

• Recurring failures: python run 27861677495 (2026-06-20T05:34Z) and again 2026-06-15T09:36Z — builds succeed, only publish fails.
• Violates the independent-per-repo-version model and the AAASM-3007 operator-gated SDK-release SOP (SDK release must wait for the FFI-pin PR merge, operator-driven). The real beta.4 publish succeeded via manual workflow_dispatch.
• The core already has a separate update-python-sdk-ffi-pin PR job, so the FFI-pin handoff does not depend on this dispatch — dropping the trigger loses nothing.

How to verify

• actionlint .github/workflows/release-python.yml is clean.
• workflow_dispatch path (the working manual release path) is unchanged.
• No remaining client_payload references.

Relates AAASM-3503. References AAASM-3007 (operator-gated SDK-release SOP).

Note: merge after confirming no in-flight release window.

🤖 Generated with Claude Code

[Chisanan232]

Merge-readiness review — AAASM-3503

Verdict: READY to approve. Safe to merge now (no in-flight release: beta.3/beta.4 already fully published; this is a release-workflow change with no runtime/registry effect).

CI — all green (4/4)

Check	Result
Analyze (python)	✅ pass
analyze	✅ pass
CodeQL	✅ pass
Run tag → PEP 440 fixture suite	✅ pass

mergeStateStatus: BLOCKED is solely REVIEW_REQUIRED (≥1 Pioneer approval) — mergeable: MERGEABLE, base master, no conflicts, no red/acceptance-class failures.

Scope vs AAASM-3503 — complete & correct (python-sdk side)

• ✅ repository_dispatch: [agent-assembly-release-published] trigger removed — on: now has exactly one live key, workflow_dispatch:.
• ✅ Unreachable repository_dispatch resolve branch removed; the resolve step now errors on any non-workflow_dispatch event.
• ✅ All live client_payload / DISPATCH_PAYLOAD_TAG references gone — the only remaining mentions are explanatory comments (lines 7, 88, 534). No dangling expressions.
• ✅ Operator workflow_dispatch path intact: pypi_version / binary_source_tag (default→latest core release) / dry-run, PEP 440 + semver validation, pep440_to_tag release_tag derivation — all preserved.
• ✅ Docs publish-release-tag job correctly repointed from github.event.client_payload.release_tag to needs.resolve.outputs.release_tag, gated if: needs.resolve.outputs.release_tag != '' (+ added resolve to needs). It now fires on exactly the operator releases that cut a SemVer tag (empty for dry-runs / .post/.dev republishes).
• ✅ create-github-release condition consistent (dry_run != 'true' && release_tag != ''). No job is left permanently unreachable on the operator path.

Notes

• Aligns with the independent-per-repo-version model and the AAASM-3007 operator-gated SDK-release SOP. The core's separate update-python-sdk-ffi-pin PR job handles the FFI-pin handoff, so dropping the dispatch trigger loses nothing.
• This fix is python-sdk only; the sibling node-sdk release-node.yml change tracked in the same ticket should be confirmed separately.

— Claude Code