chore(git): keep Bugzilla and ports@ out of the release flow

port-*-sync stays in the VERSION PR. Official ports-tree filings are
a personal follow-up, not a release step.

Author: hrodrig

.cursor/rules/git-flow.mdc

@@ -11,4 +11,4 @@ alwaysApply: true
 - **Tags:** After `main` has the merge, create an **annotated** semver tag on `main` (e.g. `v1.2.3`) and push the tag (`git push origin v1.2.3`). Tagging `develop` or a topic branch is wrong. A merge to `main` without a tag does not publish GHCR/GoReleaser.
 - **Release checks:** Before the develop → main PR / tag, **`make release-check`** must pass (see `release-tests.mdc`). Do not push a release tag if CI or Security is red.
 - **Afterward:** checkout `develop` and pull. If `main` diverged (e.g. squash merge), sync with a **PR `main` → `develop`**, not a direct push.
-- **Versions:** Semantic versioning for tags (`vMAJOR.MINOR.PATCH`). The version cut is a **dedicated PR** (`chore/release-X.Y.Z` → `develop`) — **do not mix** with features, fixes, or dependency bumps. Never bump version on `main`. That PR must include: `VERSION`, CHANGELOG `[Unreleased]` → `[X.Y.Z]`, README badge (and install URLs that pin the tag), **VHS** `docs/demo.gif` (`make install && bash -c "vhs docs/demo.tape"`), man **`.TH`** (`contrib/man/man1/pgwd.1`), **`make port-freebsd-sync`** and **`make port-openbsd-sync`**. Port *submission* (makesum, Bugzilla, ports@) is after the GitHub tag exists.
+- **Versions:** Semantic versioning for tags (`vMAJOR.MINOR.PATCH`). The version cut is a **dedicated PR** (`chore/release-X.Y.Z` → `develop`) — **do not mix** with features, fixes, or dependency bumps. Never bump version on `main`. That PR must include: `VERSION`, CHANGELOG `[Unreleased]` → `[X.Y.Z]`, README badge (and install URLs that pin the tag), **VHS** `docs/demo.gif` (`make install && bash -c "vhs docs/demo.tape"`), man **`.TH`** (`contrib/man/man1/pgwd.1`), **`make port-freebsd-sync`** and **`make port-openbsd-sync`**. Official ports-tree filings (Bugzilla, ports@) are **out of this flow** — personal follow-up, not a release step.

.cursor/rules/release-tests.mdc

@@ -16,7 +16,7 @@ Before merging to `main` or creating a release (tag and `make release`), run **`
 
 **These are NOT optional.** `make release` depends on `release-check`; if any step fails, the release is blocked.
 
-**When VERSION changes** (same `chore/release-*` PR): (1) Regenerate `docs/demo.gif` with `make install && bash -c "vhs docs/demo.tape"` from repo root (`bash -c` so zsh does not break VHS). The demo shows `pgwd -version`. See `docs/README.md`. (2) Update `contrib/man/man1/pgwd.1` — `.TH` date and version. See `man-page-sync.mdc`. (3) **`make port-freebsd-sync`** and **`make port-openbsd-sync`** so BSD port Makefiles match `VERSION`. Official ports tree updates wait until the `v*` tag is published.
+**When VERSION changes** (same `chore/release-*` PR): (1) Regenerate `docs/demo.gif` with `make install && bash -c "vhs docs/demo.tape"` from repo root (`bash -c` so zsh does not break VHS). The demo shows `pgwd -version`. See `docs/README.md`. (2) Update `contrib/man/man1/pgwd.1` — `.TH` date and version. See `man-page-sync.mdc`. (3) **`make port-freebsd-sync`** and **`make port-openbsd-sync`** so this repo’s BSD port Makefiles match `VERSION`. Do **not** treat Bugzilla or ports@ as part of the release.
 
 CI runs lint and tests. The Security workflow runs govulncheck and Grype on the image; both must pass (no `continue-on-error`). Do not push a release tag if CI or Security is red.