[salmanfarisvp]

Fixes the three Copilot comments on #46 that still apply to development.

• Feed apps on non-numeric tags (comment): update-rss-reader-apps.yml triggered on every v* tag and treated each as production, so a tag such as vrc1 on main would deploy all feed apps to production while the main app ignored it. It now triggers on v[0-9]*, like update-edge-app.yml. One step decides production with the same numeric rule, and the tag-on-main check runs off that result, so a manual run on any other ref stays on stage.
• Initialize from a non-default branch (comment): the reusable workflow builds the caller's ref, so starting Initialize from a feature branch could create an app, including in production, from code not on main. A guard job now fails the run unless it starts from the default branch, which restores the old ref: main behaviour. It fails rather than skips, so a wrong-branch run can't look like a success.
• Hard-coded release version (comment): the README release commands used the already-used v26.10.0; they now use a vYY.MM.N placeholder and say how to find the latest tag.

The other two comments on #46 no longer apply: the reusable update.yml@v26.10.2 reads the STAGE_EDGE_APP_ID/PRODUCTION_EDGE_APP_ID repo variables itself (both are set), and #47 added the tag-on-main check.

One known limit: run-name still labels a manual run on a non-numeric v tag as production, because workflow expressions can't match digits. The deploy itself goes to stage.

[Copilot]

🔵 Needs a closer look

The change affects production/stage routing and adds a branch safety gate around an external reusable deployment workflow, so its runtime paths and approval behavior require manual validation.

No open issues 🎉

What changed in this PR

This pull request hardens release workflows against unintended production deployments and non-default-branch initialization, while updating the README’s release instructions.

Changes:

• Restricts feed-app production handling to numeric v[0-9]* tags.
• Prevents Edge App initialization from non-default branches.
• Replaces the hard-coded README release version with a CalVer placeholder and tag lookup guidance.

File	Summary
README.md	Documents the placeholder-based release process. Nit: filter the latest-tag lookup to the same v[0-9]* pattern used by the workflows.
.github/​workflows/​update-rss-reader-apps.yml	Aligns feed-app production deployment and tag validation with numeric release tags.
.github/​workflows/​initialize-edge-app.yml	Blocks initialization runs started from non-default branches.

_{Review effort: Lite}