Map the image channels to how this repo ships, and disarm auto-publish

The channel work assumed the branch model it was written against: upstream,
main is a release branch and dev-be is the trunk. Neither holds here. main IS
our trunk - 212 commits past v0.11.3 - and a release is a tag (ADR-007). dev-be
does not exist at all, so the edge half would never have fired and the launchers
would have cloned a missing branch.

Taken literally it would have published our unreleased trunk to every site as
:stable, which is the opposite of what the word promises to someone who has no
way to check.

Remapped throughout:

  tag v*  -> :stable   the thing that was actually released
  main    -> :edge     the trunk, DEV badge lit

publish-images.yml keys the channel on github.ref_type = tag rather than on a
branch name, so the mapping cannot silently drift back. Start-ShopDBDev.ps1,
dev-bootstrap.ps1 and build-channel-installer.ps1 resolve stable to the newest
v* tag via git ls-remote --sort=-v:refname, warning and falling back to main if
a repo has no tags yet. DEV-BUILD-TEST.md follows.

The push: trigger is commented out. Automatic publishing waits on someone
confirming the GHCR package exists under this owner and deciding who may pull
it; workflow_dispatch works meanwhile. Turning it on is one uncomment.

All three scripts parse clean under pwsh, and the tag-selection expression was
run against this repo rather than eyeballed. Per the standing rule, the runtime
paths still want a pass in the win11 VM before anyone leans on them.

Scope: product

scripts/Start-ShopDBDev.ps1

@@ -19,7 +19,7 @@
 	GCM handles those.
 
 .PARAMETER Channel
-	'stable' (main) or 'edge' (dev-be). Defaults to 'stable'.
+	'stable' (the newest release tag) or 'edge' (main, the trunk). Defaults to 'stable'.
 
 .PARAMETER TargetDir
 	Where to clone. Defaults to %USERPROFILE%\shopdb-dev, a separate working copy
@@ -114,7 +114,18 @@ function Clear-InterruptedRun {
 # stored GitHub credential for github.com, so clone/fetch authenticate against
 # the private repo without anything sensitive touching this script or disk.
 $repoUrl = 'https://github.com/ge-aero/shopdb-flask.git'
-$branch = if ($Channel -eq 'edge') { 'dev-be' } else { 'main' }
+# Channels follow how this repo ships: a release is a TAG, the trunk is main.
+# Upstream this read 'dev-be' for edge, which is that repo's trunk branch and
+# does not exist here - the launcher would have cloned a missing branch.
+$branch = 'main'
+if ($Channel -ne 'edge') {
+	# Newest release tag, so 'stable' means a thing that was released rather
+	# than whatever the trunk happens to be today.
+	$tag = (git ls-remote --tags --refs --sort='-v:refname' $repoUrl 'v*' |
+		Select-Object -First 1) -replace '.*refs/tags/', ''
+	if ($tag) { $branch = $tag }
+	else { Write-Warning "No v* tag found; falling back to main for 'stable'." }
+}
 $target = if ($TargetDir) { $TargetDir } else { Join-Path $env:USERPROFILE 'shopdb-dev' }
 
 Write-Host "ShopDB dev launcher" -ForegroundColor White

scripts/build-channel-installer.ps1

@@ -6,7 +6,7 @@
 	Produces ONE self-contained installer package for the requested channel:
 
 	  stable -> built from 'main',   no DEV badge (SHOPDB_ENV_LABEL empty).
-	  edge   -> built from 'dev-be', red DEV badge (SHOPDB_ENV_LABEL=DEV).
+	  edge   -> built from 'main' (the trunk), red DEV badge (SHOPDB_ENV_LABEL=DEV).
 
 	This is the distributable counterpart to scripts/dev-bootstrap.ps1 (which
 	stands a dev box up FROM the repo). Here the operator has no repo: the script
@@ -28,14 +28,14 @@
 	by branch, image tag, and label - all data, not code.
 
 .PARAMETER Channel
-	'stable' (main) or 'edge' (dev-be). Required.
+	'stable' (the newest release tag) or 'edge' (main, the trunk). Required.
 
 .PARAMETER Version
 	Image tag / bundle version. Defaults to a channel-prefixed date stamp so two
 	channels built the same day never collide (e.g. 'stable-2024.06.01').
 
 .PARAMETER Ref
-	Override the git ref to build. Defaults to 'main' for stable, 'dev-be' for
+	Override the git ref to build. Defaults to the newest v* tag for stable, 'main' for
 	edge. Lets a release engineer cut an installer from a tag or fix branch.
 
 .PARAMETER MysqlImage
@@ -85,7 +85,7 @@ $ErrorActionPreference = 'Stop'
 # channel means.
 $channels = @{
 	stable = @{ Ref = 'main';   EnvLabel = '' }
-	edge   = @{ Ref = 'dev-be'; EnvLabel = 'DEV' }
+	edge   = @{ Ref = 'main'; EnvLabel = 'DEV' }
 }
 
 function Assert-LastExit([string]$What) {

scripts/dev-bootstrap.ps1

@@ -12,7 +12,7 @@
 		 passed, because the app itself runs entirely in the container.
 	  2. Picks a channel:
 		   stable  -> pulls the 'stable' image (built from main), no DEV badge.
-		   edge    -> pulls the 'edge' image (built from dev-be), red DEV badge.
+		   edge    -> pulls the 'edge' image (built from main), red DEV badge.
 		 The two channels use different compose project names, host ports, and
 		 named volumes, so they run side by side without colliding.
 	  3. Generates a .env for the channel (dev-grade secrets, NOT for production)
@@ -25,10 +25,10 @@
 	installer - see deploy/windows/installer/shopdb-install.ps1 for that.
 
 .PARAMETER Channel
-	'stable' (main) or 'edge' (dev-be). Defaults to 'stable'.
+	'stable' (the newest release tag) or 'edge' (main, the trunk). Defaults to 'stable'.
 
 .PARAMETER Ref
-	Override the git ref to build. Defaults to 'main' for stable, 'dev-be' for
+	Override the git ref to build. Defaults to the newest v* tag for stable, 'main' for
 	edge. Retained for compatibility; the pull flow selects the image by channel
 	tag, so this now only affects which branch the working tree is prepared on.
 
@@ -74,7 +74,7 @@ $channels = @{
 		ImageTag  = 'stable'
 	}
 	edge = @{
-		Ref       = 'dev-be'
+		Ref       = 'main'
 		Project   = 'shopdb-edge'
 		ApiPort   = 5011
 		MysqlPort = 3316