cimas sync 2026-07-08: rubocop todo inherit fix + release.yml bundle install

[opoudjis]

Supersedes #535 from prior cimas-sync waves.

Summary

Cimas sync 2026-07-08 — master template corrections for two release-adjacent gaps:

1. .rubocop.yml — appended .rubocop_todo.yml as the last inherit_from entry so per-gem todos take effect against the shared oss-guides config. inherit_from is last-wins; the previous ordering left the shared config's stricter Metrics/* rules overriding per-gem grandfathering, and the todo became inert. Empirically verified on suma 2026-07-06: with the todo listed first, 34 Metrics/* offenses remained; moved last, cleared. Audit confirmed all 54 gems mapping this template already carry a live .rubocop_todo.yml, so this reference is safe to emit unconditionally. See metanorma/ci:a864ed9.

2. .github/workflows/release.yml — added explicit release_command: | bundle install\n bundle exec rake release, compensating for metanorma/ci#314's bundler_cache deprecation (hardcoded to false in the release job after the metanorma-cli v1.16.6 Bundler::GemNotFound: metanorma-nist incident). Without this override, the reusable's default release_command: bundle exec rake release fires against uninstalled gems and fails. Surfaced by @kwkwan on metanorma-plugin-lutaml#285; deeper fix (bundle install inside rubygems-release.yml's release job itself) tracked at metanorma/ci#349. See metanorma/ci:f994f4c.

What to expect on your gem

• If your gem's .rubocop_todo.yml covers current offenses: CI stays green.
• If your gem's .rubocop_todo.yml has plugin-drift (missed cops from ci#334's rubocop-rspec / rubocop-performance / rubocop-rake addition, or subsequent minor releases of those plugins): CI will red on rubocop-style failures. Fix per-gem: bundle exec rubocop --regenerate-todo — same recipe as sts-ruby / suma on 2026-07-05.
• release.yml is template-only: no runtime effect until the gem's next release, at which point the two-line release_command kicks in and fixes the missing-bundle-install failure that was silent-broken before.

Wave discipline

• --flatten-stale full auto-close of prior stale cimas-sync-* wave branches on this repo.
• Fortnightly cadence maintained; this is a scheduled sync, not an emergency.

🤖