agents: document workflow presubmit rules and fix deleted packages sort (#4288)

Capture lessons from building release deliverables in presubmit so
future workflow changes avoid RBE cache busting, missing tool runfiles,
synthetic version tags, and Git version incompatibilities on older CI
runners. Also keep `RELEASING.md` focused strictly on release steps.

* Set `LC_ALL=C` when sorting in `tools/update_deleted_packages.sh` so
  output order does not depend on the host locale.

.agents/rules/docs.md

diff --git a/.agents/rules/docs.md b/.agents/rules/docs.md
index d450a5e..d292316 100644
--- a/.agents/rules/docs.md
+++ b/.agents/rules/docs.md
@@ -1,7 +1,7 @@
 ---
 trigger: glob
 description: Documentation formatting, Sphinx MyST style rules, and documentation build correctness
-globs: docs/*.md
+globs: "docs/**,RELEASING.md"
 ---
 
 # Documentation Rules
@@ -24,3 +24,5 @@
   behavioral adjustments, use `VERSION_NEXT_PATCH` in `{versionchanged}`
   directives.
 * **Documentation Build Correctness**: Ensure new `.bzl` files or user-facing APIs are properly registered in documentation build targets (e.g. `//docs:docs` or relevant Starlark API reference generation configs).
+* **`RELEASING.md` Scope**: Keep `RELEASING.md` focused strictly on how to
+  perform a release; do not document presubmit CI behavior in it.

.agents/rules/github_actions_workflows.md

diff --git a/.agents/rules/github_actions_workflows.md b/.agents/rules/github_actions_workflows.md
index 7c59824..6d39724 100644
--- a/.agents/rules/github_actions_workflows.md
+++ b/.agents/rules/github_actions_workflows.md
@@ -19,6 +19,17 @@
   (never a raw `git write-tree` SHA) to `git archive` so `.gitattributes`
   `export-subst` placeholders (such as `$Format:...$` in `python/features.bzl`)
   expand. Use `--add-file` to include generated files.
+* **Ref Handling (Tags vs. Commits)**: When a workflow or script processes a
+  release tag or a commit (e.g. in presubmit), use that exact tag or commit SHA
+  value throughout. Never invent dummy version strings (e.g. `0.0.0-dev`) or
+  create synthetic git tags to work around downstream logic.
+* **No `--stamp` or `--embed_label` on Pull Requests**: Only pass `--stamp` and
+  `--embed_label` on release builds, never on `pull_request` builds, to avoid
+  busting remote/RBE caching.
+* **Direct `bazel-bin/` Tool Execution**: When a workflow step runs a Bazel
+  binary directly from `bazel-bin/<pkg>/<target>` instead of `bazel run`,
+  explicitly include `//<pkg>:<target>` in `bazel build` so its `.runfiles` tree
+  is materialized.
 
 ## Workflow Scripts & Testing
 * **Separate Script Files (No Inline Scripts)**: Factor non-trivial scripts
@@ -35,3 +46,7 @@
   entry point (e.g. `process_comment()`) and private helpers (`_` prefix). Write
   outputs directly when matching actions. Test end-to-end via autouse fixtures
   for GHA env files and API mocks.
+* **Git Portability in Workflow Tests**: CI runs on older Linux distributions
+  with Git `< 2.35` (e.g. Debian 11, Ubuntu 22.04), where
+  `%(describe:tags=true)` is unsupported. Guard assertions on Git $\ge$ 2.35
+  format options with a host Git capability check.

tools/update_deleted_packages.sh

diff --git a/tools/update_deleted_packages.sh b/tools/update_deleted_packages.sh
index 83bed91..4488759 100755
--- a/tools/update_deleted_packages.sh
+++ b/tools/update_deleted_packages.sh
@@ -36,6 +36,6 @@
         xargs -I{} find {} \( -name BUILD -or -name BUILD.bazel \) |
         xargs -n 1 dirname |
         grep -v "gazelle/docs" |
-        sort -u |
+        LC_ALL=C sort -u |
         sed 's/^/common --deleted_packages=/g' 
 } | tee "$DIR"/.bazelrc.deleted_packages