docs: Add release tagging procedure and finalize-release script

Document the release workflow in AGENTS.md, splitting it into
agent-preparable draft steps and human-only finalization.  Add
scripts/finalize-release which amends the version bump commit with
Signed-off-by, creates a signed tag, and optionally invokes kup-dtc
for upload.  Remove the now-redundant dist and kup targets from the
Makefile.

Assisted-by: Claude:claude-opus-4-6
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>

AGENTS.md

@@ -87,6 +87,51 @@ See the "AI Coding Assistants" section in CONTRIBUTING.md. Key rules:
 - Use `Assisted-by: AGENT_NAME:MODEL_VERSION [TOOL1] [TOOL2]` for attribution in commit messages
 - The human submitter is responsible for reviewing all AI-generated code and ensuring license compliance
 
+## Tagging a New Release
+
+Releases use the `vMAJOR.MINOR.PATCH` tag format (e.g., `v1.7.2`).
+
+An AI agent can prepare the release; the human maintainer reviews,
+adds `Signed-off-by`, and signs the tag.
+
+1. **Update `VERSION.txt`** — change the single line to the new version
+   number (e.g., `1.7.2`). `meson.build` reads its version from this
+   file. No other version files need editing.
+
+2. **Draft the version bump commit** — create the commit *without*
+   `Signed-off-by` (agents must not add S-o-b per the AI contribution
+   policy). Use the message format:
+   ```
+   Bump version to vX.Y.Z
+
+   Prepare for a new release.
+   ```
+
+3. **Draft the tag message** — write it to a temporary file (e.g.,
+   `tag-message.txt`) for the maintainer to review. The format is:
+   ```
+   DTC X.Y.Z
+
+   Changes since vPREV include:
+    * Component
+      - Change description
+      - ...
+   ```
+   Group changes by component (dtc, libfdt, pylibfdt, fdtget,
+   fdtoverlay, Build, General, etc.) with a bullet per notable change.
+   Generate the changelog from `git log vPREV..HEAD`.
+
+4. **Human review** — the maintainer reviews the commit and tag
+   message, then runs the finalize script which amends the commit to
+   add `Signed-off-by` and creates the signed annotated tag:
+   ```sh
+   scripts/finalize-release tag-message.txt
+   ```
+
+Agents must **never** run `scripts/finalize-release` or
+`scripts/kup-dtc`. These perform signing and upload operations that
+only a human maintainer may execute.
+
 ## Coding Conventions
 
 - License: GPL-2.0-or-later for dtc tools; (GPL-2.0-or-later OR BSD-2-Clause) for libfdt

Makefile

@@ -255,29 +255,6 @@ fdtput:	$(FDTPUT_OBJS) $(LIBFDT_dep)
 
 fdtoverlay: $(FDTOVERLAY_OBJS) $(LIBFDT_dep)
 
-dist:
-	git archive --format=tar --prefix=dtc-$(dtc_version)/ HEAD \
-		> ../dtc-$(dtc_version).tar
-	cat ../dtc-$(dtc_version).tar | \
-		gzip -9 > ../dtc-$(dtc_version).tar.gz
-
-
-#
-# Release signing and uploading
-# This is for maintainer convenience, don't try this at home.
-#
-ifeq ($(MAINTAINER),y)
-GPG = gpg2
-KUP = kup
-KUPDIR = /pub/software/utils/dtc
-
-kup: dist
-	$(GPG) --detach-sign --armor -o ../dtc-$(dtc_version).tar.sign \
-		../dtc-$(dtc_version).tar
-	$(KUP) put ../dtc-$(dtc_version).tar.gz ../dtc-$(dtc_version).tar.sign \
-		$(KUPDIR)/dtc-$(dtc_version).tar.gz
-endif
-
 tags: FORCE
 	rm -f tags
 	find . \( -name tests -type d -prune \) -o \

scripts/finalize-release

@@ -0,0 +1,71 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Finalize a release (possibly prepared with AI agent assistance)
+# Amends the version bump commit to add Signed-off-by, then creates a
+# signed annotated tag from the drafted tag message.
+
+set -e
+
+usage() {
+	echo "Usage: $0 <tag-message-file>" >&2
+	echo "" >&2
+	echo "Run this from the repository root with VERSION.txt updated" >&2
+	echo "and a draft tag message in given file." >&2
+	exit 1
+}
+
+TAG_MSG_FILE="$1"
+if [ -z "$TAG_MSG_FILE" ] || [ ! -f "$TAG_MSG_FILE" ]; then
+	usage
+fi
+
+VERSION=$(cat VERSION.txt)
+TAG="v${VERSION}"
+
+if git rev-parse "$TAG" >/dev/null 2>&1; then
+	echo "Error: tag $TAG already exists" >&2
+	exit 1
+fi
+
+HEAD_SUBJECT=$(git log -1 --format=%s)
+EXPECTED="Bump version to $TAG"
+if [ "$HEAD_SUBJECT" != "$EXPECTED" ]; then
+	echo "Error: HEAD commit subject is:" >&2
+	echo "  $HEAD_SUBJECT" >&2
+	echo "Expected:" >&2
+	echo "  $EXPECTED" >&2
+	exit 1
+fi
+
+echo "Version:  $VERSION"
+echo "Tag:      $TAG"
+echo ""
+echo "--- Tag message ---"
+cat "$TAG_MSG_FILE"
+echo "--- End tag message ---"
+echo ""
+
+printf "Proceed? [y/N] "
+read answer
+case "$answer" in
+	y|Y) ;;
+	*) echo "Aborted."; exit 1 ;;
+esac
+
+git commit --amend -s --no-edit
+git tag -s "$TAG" -F "$TAG_MSG_FILE"
+
+echo ""
+echo "Created signed tag $TAG."
+echo "Review with: git show $TAG"
+echo ""
+
+SCRIPTDIR=$(dirname "$0")
+
+printf "Upload to kernel.org via kup? [y/N] "
+read answer
+case "$answer" in
+	y|Y) "$SCRIPTDIR/kup-dtc" "$VERSION" ;;
+	*) echo "Skipping kup upload." ;;
+esac