Answer prose round 1: 0 🔴, 6 🟡 (0 misread); the never-on-main reason sits at on:, the overview paragraph stops narrating its test, the AGENTS bullet splits into sentences

.gitea/workflows/release.yml

@@ -1,4 +1,5 @@
 name: Release
+# The Hub overview names a released tag, so it is published here only, never on a push to main.
 on:
   push:
     tags: ['v[0-9]+.[0-9]+.[0-9]+']
@@ -81,8 +82,7 @@ jobs:
       - uses: actions/checkout@v7.0.1
         if: github.event_name == 'push'
       # Publish the named release's own tree, so the page never pairs one Plainpages tag with another
-      # release's sidecar pins, which is also why it never syncs on a push to main. A version that
-      # was never released fails here.
+      # release's sidecar pins. A version that was never released fails here.
       - uses: actions/checkout@v7.0.1
         if: github.event_name == 'workflow_dispatch'
         with:

.gitea/workflows/renovate.yml

@@ -38,8 +38,7 @@ jobs:
       - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
-          # A persisted token rides every request as an extraheader, outranking the PAT in the push
-          # URL: Gitea then sees the Actions bot push the tag and starts no workflow for it.
+          # A persisted token outranks the PAT in the push URL, and Gitea runs nothing for its pushes.
           persist-credentials: false
       - name: Tag a release for what Renovate merged
         env: