build: make maintainer workflows branch-safe

[loadingalias]

What changed

• Document the daily contribution and release operator workflows.
• Make just push run one checked-in, change-aware validation path and set the current branch upstream.
• Remove the machine-local rscrypto pre-push hook and all hook-coordination state.
• Prepare releases through a pull request instead of attempting to write protected main.
• Ignore local Ruff cache output.

Why

Protected main and the required Complete check remain the enforcement boundary. Local validation is a portable repository command rather than untracked hook state, so a fresh clone has the same supported workflow without installation or duplicate execution.

Validation

• just check-actions
• scripts/ci/pre-push-test.sh
• scripts/ci/release-recipes-test.sh
• shellcheck -x on the modified shell scripts
• just --fmt --check
• lychee --offline CONTRIBUTING.md docs/release.md README.md
• hook-free just push completed with one validation pass