fix(#161): de-hardcode master in CONTRIBUTING and CI workflows

[devallibus]

Summary

Fixes the two cohesion regressions codex flagged on PRs #158/#159/#160 after they had already been squash-merged: hardcoded master references in CONTRIBUTING.md instructions and in both new GitHub Actions workflows.

Closes #161

Journey Timeline

What we discovered (post-merge)

After the four-PR #156 batch was merged in rapid succession, the codex bot completed its review and posted P1 line-comments on the three closed PRs:

• docs(#156/T2): add CONTRIBUTING.md with versioning policy #158 / CONTRIBUTING.md line 48: "Branch from master" hardcodes a branch name; the project moved to <default-branch> language in PR fix(#154): use <default-branch> in SKILL.md Step 2 walkthrough #155 four days earlier.
• ci(#156/T3): add version-bump-check workflow #159 / version-bump-check.yml line 13: branches: [master] filter would silently no-op if the repo were ever renamed to main.
• ci(#156/T4): add release-on-version-change workflow #160 / release.yml line 15: same branches: [master] brittleness on the release workflow.

Codex's stated premise (that shiplog's default branch is main) is wrong — gh repo view confirms the default is master, so today the workflows do fire as intended. But the broader concern is correct: the project's own <default-branch> convention from PR #155 was just split again, and a future rename would silently break CI.

Decisions

Decision	Choice	Why
Workflow fix shape	branches: [master, main] literal list	GitHub Actions does not template the branches: filter, so two-branch literal is the simplest correct shape. Cheap belt-and-suspenders that survives a rename.
Doc fix shape	<default-branch> placeholder	Matches the convention SKILL.md adopted in PR #155. Keeps the project consistent with itself.
Process learning	Wait for codex before merging shiplog PRs	Comment block in this PR body. Future shiplog PRs should give the bot at least 2 minutes after open before merging, OR explicitly comment @codex review after merge to backfill. We are doing the former on this one.

Changes

• CONTRIBUTING.md:
  • "Branch from master" → "Branch from your <default-branch>".
  • "Each version bump on master triggers..." → "Each version bump on the default branch triggers...".
  • Manual release example: --target master → --target <default-branch>.
• .github/workflows/version-bump-check.yml: branches: [master] → branches: [master, main] with an inline comment explaining the rationale.
• .github/workflows/release.yml: same change with the same explanatory comment.

No changes under commands/, skills/, or .claude-plugin/ — so the version-bump-check workflow this PR adjusts will pass without a plugin.json bump (and the absence of one is intentional and documents that the workflow exempts non-gated paths correctly).

Testing / Verification

• Diff is three files, all small, scoped exactly to the codex findings.
• The version-bump-check workflow will run against this PR (it triggers on PRs to master, which is what this PR targets) and should pass since no gated paths changed.
• The release workflow does not run on PRs, only on push to master/main, so its behavior is verified next time plugin.json version is bumped.
• Spot-checked the diff for any other surviving "master" references in CONTRIBUTING.md / new workflows — none remain that are policy or instruction. (README.md mentions of "master" in unrelated narrative are out of scope here.)

Knowledge for Future Reference

• Process: when opening multiple shiplog PRs in rapid succession, allow codex at least 2 minutes between open and merge so its line-level findings have time to land. The bot posts a "Reviewed commit: " boilerplate immediately, then files findings (or a 👍 reaction) seconds-to-minutes later. Merging during that window means findings land on closed PRs.
• Pattern: the codex bot uses GitHub user chatgpt-codex-connector[bot] (with the [bot] suffix in the API). gh pr view --jq '.author.login' strips the suffix; the raw API does not. When automating bot-finding inspection, query the raw API to be sure.
• Convention: going forward, any new docs or CI in this repo that names a branch should use <default-branch> (docs) or list both master, main (CI branches: filters). PR fix(#154): use <default-branch> in SKILL.md Step 2 walkthrough #155 is the precedent.

---

Authored-by: claude/opus-4.7 (claude-code)
Captain's log - PR timeline by shiplog

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.

[devallibus]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devallibus]

[shiplog/review] #162: Cross-model review — approve via codex 👍 + repo owner authorization

This time we waited for codex before merging. Codex completed its review on PR #162 and returned a clean signal:

• 👍 reaction on the PR at 2026-04-22T10:32:57Z (codex's documented "no findings" indicator)
• Comment: "Codex Review: Didn't find any major issues. More of your lovely PRs please." at 2026-04-22T10:32:58Z
• No formal review state, no inline review comments, no findings

Per skills/shiplog/references/closure-and-review.md §3, codex's 👍 + clean comment from the chatgpt-codex-connector[bot] account is independent cross-model signal (codex / openai vs claude/opus-4.7 author). Repo owner (devallibus) additionally authorized merge to maintain the override pattern from the #156 batch.

Reviewed-by: claude/opus-4.7 (claude-code)
Disposition: approve
Scope: full diff — CONTRIBUTING.md, .github/workflows/version-bump-check.yml,
       .github/workflows/release.yml. Verified codex 👍 reaction and clean-review
       comment from chatgpt-codex-connector[bot] before recording this disposition.
Note: Process correction from #156 batch — codex was given time to review
before merge this round. Findings on prior PRs (#158/#159/#160) drove
this PR's scope and are addressed by it.

Authored-by: claude/opus-4.7 (claude-code)