[SDAChess]

Summary

Publish the public protobuf schemas to buf.build/openshell/core during stable releases, using the release tag as the Buf label and linking to the exact release source commit. Prereleases skip Buf publication.

Related Issue

No tracking issue, as requested.

Changes

• Add a stable-only publication job to the shared release workflow and forward BUF_TOKEN from the stable caller.
• Name the public Buf module and explicitly publish only proto/ with nix develop -c buf push proto.
• Include Buf in the Nix development shell and document publication and setup requirements.

Release Notes

Testing

• buf build passes using Buf from the pinned Nix inputs; nix develop -c buf build proto also passes for the explicit public input.
• Actionlint passes for the changed workflows with the existing unsupported concurrency.queue diagnostic filtered. The unfiltered run reports only that existing key.
• Zizmor reports no medium or high findings for the changed workflows.
• Nix formatting and git diff --check pass.
• Live registry publication was not run locally; it runs during a stable release.
• Pre-commit hook skipped as requested.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• CI documentation and release guidance updated

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-5208.docs.buildwithfern.com/openshell