Simplify documentation and add repository development skill

docs/PUBLISHING.md

@@ -1,17 +1,26 @@
-# Publish to tea.karlcom.de
+# Publishing
 
-This directory is the clean repository root. The surrounding research workspace is not the repository and must not be uploaded.
+The canonical repository is [karl/whatsapp_injector](https://tea.karlcom.de/karl/whatsapp_injector). Publish from its clean Git root, not the surrounding research workspace.
 
-1. The configured repository is `https://tea.karlcom.de/karl/whatsapp_injector.git`.
-2. Copy the SSH or HTTPS clone URL supplied by the server. Use your existing credential manager or SSH configuration; never embed tokens in the URL.
-3. From this directory, inspect the tracked file list and configure the remote:
+## Upload a reviewed change
+
+Rebuild and test when source, assets or tests changed; use the [development workflow](../CONTRIBUTING.md). Documentation-only changes need accurate examples and valid links.
 
 ```powershell
-git ls-files
-git remote add origin https://tea.karlcom.de/karl/whatsapp_injector.git
-git push -u origin main
+git status --short
+git diff --cached
+git remote -v
+git push origin main
 ```
 
-The owner and remote URL were supplied by Karl. Repository visibility is controlled on the server. Never push the surrounding research workspace.
+Stage only maintained source, documentation, synthetic fixtures and required runtime assets. Review staged files before committing. Exports, profiles, credentials, protected listener configurations and research captures belong outside Git.
 
-For a release, rebuild and test the bundle, then attach only `whatsapp.py` and a SHA-256 checksum to a server release. State the tested Desktop build and optional dependencies. Do not attach test exports or research reports. No server-specific CI workflow is included because runner availability and configuration have not been verified.
+An existing clone already has its remote configured. If moving a repository to a different server, configure the intended URL explicitly; never embed a token in it. Use an existing credential manager or SSH setup.
+
+## Portable release
+
+Build and test `whatsapp.py`, then attach that file and its SHA-256 checksum to a release. Include the tested Desktop build, Python/platform requirements, relevant live validation and untested cases.
+
+The runtime file contains the native DLLs; users need no compiler. It must run from a writable folder. Do not attach private test outputs. Embedded hashes establish integrity, not a publisher signature.
+
+Repository visibility is controlled on the server. No open-source license has been selected; see [licensing status](../LICENSE.md). No server-specific CI workflow is included because runner availability has not been verified.