ci(roadmap): close the release batch automatically on tag (CS-77)

[RudneyForti]

Summary

Completes the roadmap automation chain. Merging already moves a card to Concluídas; now tagging closes the batch: pushing a v* tag stamps that version on the merged-but-unreleased cards, so the "Em aberto" bucket folds into its release group with no manual step.

The rule it enforces

Per AGENTS.md → Versioning authority, a card's version is a claim that the work shipped in that release. So the script does not blanket-stamp everything unversioned — it verifies each card with git merge-base --is-ancestor <commitHash> <tag>:

• Card merged before the tag → stamped
• Card merged after the tag was cut → stays in "Em aberto" for the next release
• Card with no commitHash → left untouched (never guessed)
• Non-release tag (banana) → refused, exit 1
• Re-run on the same tag → no-op (idempotent)

This makes the phantom-version bug that started the versioning work (a v1.15.0 group git never tagged) structurally impossible.

Changes

• .github/workflows/release-sync.yml — on push of v* (plus workflow_dispatch to reprocess a tag manually); checks out main with full history so the containment check has a real graph; commits the board with [skip ci]
• scripts/roadmap-stamp-release.mjs — the stamping logic
• tests/unit/release-sync.test.ts — 6 cases run against a throwaway git repo with a real commit graph and a real tag; mocking git would have tested nothing
• AGENTS.md / GIT-WORKFLOW.md — E7 stamping documented as automatic, no longer NEO's job

Verified locally against the real repo

v1.16.0 → stamped 1.16.0 on 6 card(s): CS-49, CS-71, CS-72, CS-73, CS-74, CS-76
v1.15.4 → nothing to stamp (all six correctly reported "fora da tag")
banana  → refused, exit 1

After merge

I'll trigger workflow_dispatch with v1.16.0 to close the current batch — which both delivers the stamping and proves the automation end-to-end on the real board.

Checklist

• Link to feature/issue: CS-77
• Description of changes included above
• List of additions documented
• All existing tests are passing (119)
• New tests were added for this change (6 cases, real git graph)
• Agent Smith validated behavior (script exercised against the live repo — see results above)
• No regressions observed

References

CS-77 · follows CS-73 (merge sync) and CS-76 (dual-source board)