ci: persist extended-stable Docker completion

docs/reference/RELEASING.md

@@ -204,7 +204,11 @@ saved npm preflight artifact, exact `Full Release Validation` evidence, exact np
 version and `extended-stable` selector, and published tarball digest. It then
 creates or resumes a canonical non-prerelease GitHub Release draft with
 `latest=false`, calls the reusable `Docker Release` workflow, and makes the
-draft public only after Docker succeeds. A tag push never publishes Docker
+draft public only after Docker succeeds. After image, attestation, platform,
+and channel-alias verification, Docker Release records a success status on the
+immutable release SHA. Retries skip a rebuild only when that exact durable
+status and its release-workflow run are verified; a public GitHub Release page
+alone is never Docker-completion evidence. A tag push never publishes Docker
 images or a release page by itself:
 
 ```bash

docs/reference/full-release-validation.md

@@ -52,6 +52,11 @@ gh workflow run full-release-validation.yml \
   -f release_profile=stable
 ```
 
+The Docker-only closeout derives `extended-stable/YYYY.M.33` from the final
+`.33+` tag, requires the tag commit to be reachable from that exact branch, and
+passes that branch to the validation-evidence verifier. It does not substitute
+the closeout workflow's `main` ref for the candidate branch.
+
 The helper's temporary `release-ci/*` ref is valid only when every child uses
 the pinned trusted workflow SHA and the v3 manifest binds the canonical branch,
 exact release commit, run ID, and attempt. Reject narrow runs, stale attempts,