Version bump moved to agents: guard the loop, PR the push

Root cause category: CI/CD — auto-commit workflow on a protected, PR-only branch Module: repo plumbing (CI), Release Version.yml

What happened

For the release train, the patch version bump moved off main onto the long-lived agents branch (decision 6): each merge to agents bumps version.txt (+ synced gradle/DEBIAN/doc fields), and main inherits the accumulated version when Ben merges the integration PR. Two things made the naive port unsafe:

1. agents is PR-only (branch protection requires a PR), so the old workflow’s git push straight to the branch would be rejected.
2. A workflow that triggers on push: [agents] and then pushes a bump commit would re-trigger itself — an infinite bump loop.

The old workflow also created the vX.Y.Z tag; in the new model tagging happens once on merge to main (release-notes.yml), so keeping it here would double-tag.

Fix

• Re-pointed the trigger from push: [main] to push: [agents].
• Loop guard: the job skips when head_commit.message starts with Bump version, so the squashed bump commit doesn’t trigger another bump.
• PR + automerge: the bump is committed on a version-bump/<v> branch, pushed with the krill-kraken-bot PAT (so CI triggers), opened as a risk:trivial / no-lesson-needed PR to agents, and gh pr merge --auto --squash. With agents required-reviews = 0 and CI green, it merges with no human approver.
• Removed the tag step — this workflow is now bump-only.

Prevention

• Any auto-commit workflow on a protected, PR-only branch must (a) guard against self-trigger and (b) reach the branch via PR + automerge, never a direct push.
• Push bot branches with a PAT, not the default GITHUB_TOKEN, when you need the push to trigger downstream workflows (CI on the bump PR, here).
• Keep tag creation in exactly one place. Moving a bump across branches is a good moment to audit for double-tagging.