ci: run release train on plain UTC cron, drop Prague hour gate

.github/dependabot.yml

@@ -5,8 +5,8 @@ updates:
     schedule:
       interval: 'weekly'
       day: 'friday'
-      time: '18:00'
-      timezone: 'Europe/Prague'
+      time: '16:00'
+      timezone: 'Etc/UTC'
     assignees:
       - 'vreshch'
     open-pull-requests-limit: 10
@@ -20,8 +20,8 @@ updates:
     schedule:
       interval: 'weekly'
       day: 'friday'
-      time: '18:00'
-      timezone: 'Europe/Prague'
+      time: '16:00'
+      timezone: 'Etc/UTC'
     assignees:
       - 'vreshch'
     open-pull-requests-limit: 5

.github/workflows/release-train.yml

@@ -3,21 +3,22 @@ name: Release Train
 # Fully automated Friday MINOR release of @agentage/server-memory to npm. No human
 # step on the happy path. Weekly cadence, always a minor bump.
 #
-# Level 1 (dep-driven): this package wraps @agentage/memory-core, whose own train
-# releases at 20:00 Prague. This one runs at 21:00 so it can pull the fresh core.
+# Level 1 (dep-driven): this package wraps @agentage/memory-core, whose own L0 train
+# runs at 19:00 UTC. This one runs at 20:00 UTC so it can pull the fresh core.
 # Before the version bump it upgrades every @agentage/* dependency to latest; a dep
 # change ALONE justifies releasing (the whole point of L1). The frozen 6-tool
 # contract means `npm run verify` against the bumped memory-core is the integration
 # gate - a red verify fails the train without releasing (the PR stays open).
 #
+# Single UTC cron, no Prague/DST gate: a late-firing cron just means the train
+# departs late, not that it gets skipped.
+#
 # GITHUB_TOKEN caveats handled here: its branch pushes don't fire pr-validation on
 # the release PR (the in-workflow `npm run verify` plus the one in publish.yml are
 # the CI gates), and its merges don't fire publish.yml's push trigger - so after
 # merging, this workflow dispatches publish.yml explicitly.
 on:
   schedule:
-    # Friday 21:00 Europe/Prague, both DST offsets; the gate job filters.
-    - cron: '0 19 * * 5'
     - cron: '0 20 * * 5'
   workflow_dispatch:
 
@@ -27,33 +28,8 @@ permissions:
   actions: write
 
 jobs:
-  prague-gate:
-    name: 🕘 Friday 21:00 Prague gate
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    outputs:
-      go: ${{ steps.gate.outputs.go }}
-    steps:
-      - name: Check local Prague hour (DST-proof)
-        id: gate
-        run: |
-          if [ "${{ github.event_name }}" != "schedule" ]; then
-            echo "workflow_dispatch - bypassing hour gate."
-            echo "go=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          HOUR=$(TZ=Europe/Prague date +%H)
-          if [ "$HOUR" = "21" ]; then
-            echo "go=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "Prague hour is $HOUR, not 21 - wrong DST cron slot, skipping."
-            echo "go=false" >> "$GITHUB_OUTPUT"
-          fi
-
   dependabot-quiescence:
     name: 🤖 Wait for dependabot triage to finish
-    needs: prague-gate
-    if: needs.prague-gate.outputs.go == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 50
     steps:
@@ -76,8 +52,7 @@ jobs:
 
   release:
     name: 🚝 Cut minor release
-    needs: [prague-gate, dependabot-quiescence]
-    if: needs.prague-gate.outputs.go == 'true'
+    needs: dependabot-quiescence
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -138,7 +113,7 @@ jobs:
         if: steps.guard.outputs.skip != 'true'
         run: |
           set -euo pipefail
-          # L1: pull the fresh @agentage/* line (memory-core released at 20:00).
+          # L1: pull the fresh @agentage/* line (memory-core L0 released at 19:00 UTC).
           npx --yes npm-check-updates -u --dep prod,dev --filter "@agentage/*"
           npm install
           if git diff --quiet -- package.json package-lock.json; then