Limit Continuous Release to master CI runs

.github/workflows/continuous_release.yml

@@ -4,6 +4,7 @@ on:
   workflow_run:
     workflows: [CI]
     types: [completed]
+    branches: [master]
   workflow_dispatch:
     inputs:
       release_impact:

AGENTS.md

@@ -83,4 +83,5 @@ Before finalizing, always run the full pipeline: `Invoke-Build -Task Lint, Build
 - `.github/workflows/ci.yml` is the required quality gate for runtime/code changes.
 - `.github/workflows/module_ci.yml` owns the reusable module build, platform-test, optional smoke-test, and release-candidate pipeline.
 - Keep downstream `ci.yml` files limited to triggers, permissions, immutable workflow inputs, and the caller-side `CI Result` compatibility job.
+- Continuous release callers listen only for completed `CI` runs on `master`; pull-request CI must not start release orchestration.
 - CI path filters may skip pull request validation for documentation and metadata-only changes. CI always runs for `master` pushes so every merged release-labelled change reaches release planning.

Tests/WorkflowTriggers.Tests.ps1

@@ -0,0 +1,9 @@
+#requires -modules @{ ModuleName = "Pester"; ModuleVersion = "5.9.0"; MaximumVersion = "5.9.999" }
+
+Describe 'GitHub Actions workflow triggers' -Tag 'Lint', 'Unit' {
+    It 'starts continuous release only for completed CI runs on master' {
+        $workflow = Get-Content "$PSScriptRoot/../.github/workflows/continuous_release.yml" -Raw
+
+        $workflow | Should -Match '(?ms)workflow_run:.*?workflows:\s*\[CI\].*?types:\s*\[completed\].*?branches:\s*\[master\]'
+    }
+}

docs/BlueprintHelpers.md

@@ -104,7 +104,8 @@ Task SetVersion {
 
 Release automation should fold pending changelog entries and custom fragments into the next version section, then delete the consumed fragments.
 Use the `prepare-release-changelog` composite action instead of exporting another module helper for GitHub-only release mechanics.
-In the continuous release workflow, commit the resulting `CHANGELOG.md` update and `.changelog` deletions directly to `master` after a release-labelled PR merges.
+In the continuous release workflow, commit the resulting `CHANGELOG.md` update and `.changelog` deletions directly to `master` after a release-labelled PR merges.
+Automatic continuous release runs should listen only for completed `CI` workflows on `master`; keep manual dispatch available for unreleased changes already on `master`.
 Commit the source module manifest version in the release metadata commit. Stamp release notes only into the final artifact in secretless candidate CI, then package and validate it before upload; the source manifest keeps release notes empty and the publisher does not rebuild.
 For manual release preparation, commit source version and changelog before tagging the release.
 

docs/ReleaseBlueprint.md

@@ -166,6 +166,7 @@ on:
   workflow_run:
     workflows: [CI]
     types: [completed]
+    branches: [master]
   workflow_dispatch:
     inputs:
       release_impact: