Require Manager clone gate before Registry publish

README.md

@@ -57,8 +57,19 @@ python3 tools/verify_manager_install.py --source .
 The gate reads the public repository from `pyproject.toml`, disables ambient
 Git credentials, performs Manager's recursive clone into a clean
 `custom_nodes` directory, verifies the release commit and version tag, and
-compiles every shipped Python and JavaScript source from the clone. The Gitea
-tag workflow runs the same command before a release is considered installable.
+compiles every shipped Python and JavaScript source from the clone.
+
+Registry publishing is supported only through the gated release command:
+
+```bash
+python3 -m tools.publish_registry_release \
+  --changelog "Describe this release"
+```
+
+It runs the Manager installation gate and Registry validation before invoking
+publication. The API key is read interactively and sent to `comfy` over
+standard input; it is never placed in process arguments or environment
+variables. Direct `comfy node publish` calls bypass the required release gate.
 
 ## License