[lthibault]

The legacy IPFS release job uses VPS SSH access and Kubernetes. Place that job on hold before the separately authorized VPS migration.

Set jobs.publish.if to ${{ false }}. Current workflow definitions cannot schedule the job on master pushes, manual dispatch, or other events. Preserve its scripts and dependencies. Every other workflow value remains unchanged, including Rust/metrics CI, formatting, Clippy, release builds, validation, and GHCR publication.

Extend the release-workflow regression test to require the hold and preserve all other job admission conditions. Add an operational fencing runbook and the changelog entry required by the existing changelog check.

Validation:

• Seven affected shell regression suites, Bash syntax checks, ShellCheck, and diff checks passed.
• YAML parsing and full semantic comparison confirm only publish.if changed.
• 10,240 local admission scenarios passed; nine mutation controls failed as expected, including restoration of the old condition and push/dispatch bypasses.
• actionlint found only its existing concurrency.queue schema limitation and the intentional constant-false diagnostic. No other findings remained after filtering those exact messages.
• Independent Extra High review found a missing required changelog entry, now corrected; no unresolved defects remain.

Full Rust/build/container CI and live Actions scheduling were not run locally.

This condition does not fence historical or rerunnable workflows, dispatch to old refs, existing SSH sessions, direct/local publishers, or operations already accepted by Kubo. The runbook requires separate approval for credential revocation, process termination, restart prevention, and Kubo quiescence. Replacing the old IPNS identity is approved in principle but is not performed here.

Related: https://github.com/wetware/infra/issues/38

No production or credential changes. Production cutover remains HOLD.