fix: match Release Please root title

RELEASING.md

@@ -232,8 +232,9 @@ The repository maintains four independently auditable workflows:
   first failure. Standalone and release smoke jobs share one repository-wide
   concurrency group. Scheduled and manual live execution requires
   `LIVE_SMOKE_ENABLED=true`.
-- `release-please.yml`: patch-only versioning, an explicit `cometapi` component,
-  separate pull requests, and an explicit component/version title. It requires
+- `release-please.yml`: patch-only versioning, an explicit `cometapi` branch
+  component, separate pull requests, and the pinned root-package title
+  `chore(main): release <version>`. It requires
   `RELEASE_PLEASE_ENABLED=true` and uses the default `GITHUB_TOKEN`. The
   authorized repository baseline keeps default workflow permissions read-only
   and allows Actions to create pull requests; it does not make bot review valid

ROADMAP.md

@@ -114,11 +114,13 @@ a human owner reviews its exact final head. Default workflow permissions remain
 read-only, bot approval is never accepted, and the workflow does not modify the
 repository setting. Patch-only versioning prevents an implicit 0.2 bump during
 this maintenance window. The temporary anchor must be removed in that release
-PR before merge. The explicit component does not enter the public tag; the only
-accepted patch tag is `v0.1.1`. Publication is triggered from the successful
-attempt-qualified Release Please push run and independently verifies that run's
-schema-v2 result artifact, default-branch commit, tag, immutable Release, and
-package artifact before the existing bounded live smoke and npm OIDC steps. A
+PR before merge. The explicit component identifies the temporary branch but,
+for this root package, does not enter the Release Please title or public tag;
+the only accepted patch tag is `v0.1.1`. Publication is triggered from the
+successful attempt-qualified Release Please push run and independently verifies
+that run's schema-v2 result artifact, default-branch commit, tag, immutable
+Release, and package artifact before the existing bounded live smoke and npm
+OIDC steps. A
 push rerun is bounded to the same run ID, SHA, candidate, Release-producing
 attempt, and exact Release state; manual preparation remains attempt-1-only.
 The Release notes must equal the reviewed `CHANGELOG` entry. The post-merge run also

scripts/release-workflow-validation.mjs

@@ -63,7 +63,7 @@ function stablePatch(version, label) {
 }
 
 function releaseTitle(version) {
-  return `chore(main): release cometapi ${version}`;
+  return `chore(main): release ${version}`;
 }
 
 function normalizeMarkdown(value, label) {

tests/release-workflow-validation.test.mjs

@@ -65,7 +65,7 @@ function pullRequestFixture({ merged = false, version = "0.1.1" } = {}) {
     mergedAt: merged ? "2026-07-29T00:00:00Z" : null,
     number: 31,
     state: merged ? "closed" : "open",
-    title: `chore(main): release cometapi ${version}`,
+    title: `chore(main): release ${version}`,
   };
 }
 
@@ -326,6 +326,15 @@ describe("Release Please pull request preparation", () => {
     });
   });
 
+  it("rejects an invented component in the pinned root-package title", () => {
+    const state = preparedState();
+    state.actionPullRequests[0].title = "chore(main): release cometapi 0.1.1";
+    state.pullRequest.title = "chore(main): release cometapi 0.1.1";
+    expect(() => validatePreparedReleasePullRequest(state)).toThrow(
+      /release pull request title/i,
+    );
+  });
+
   it("accepts an unchanged existing action-authored PR when the action returns no output", () => {
     expect(
       validatePreparedReleasePullRequest(