docs: fix release tempdir cleanup order

CHANGELOG.md

@@ -5,6 +5,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- **The release runbook now keeps its verification workspace alive through the negative Python-floor check.**
+  `docs/RELEASE_PROTOCOL.md` no longer deletes `TMP_DIR` before the explicit Python 3.12
+  rejection step, and the documentation contract tests now enforce that cleanup happens only after
+  the positive install proof and the negative floor proof have both run.
+
 ## [0.167.0] - 2026-05-15
 
 ### Changed

docs/RELEASE_PROTOCOL.md

@@ -400,7 +400,6 @@ gh release download vX.Y.Z \
 uv venv --python 3.13 --seed "$TMP_DIR/py313"
 "$TMP_DIR/py313/bin/pip" install --no-cache-dir "ftllexengine==X.Y.Z"
 "$TMP_DIR/py313/bin/python" -c "import ftllexengine as pkg; print(pkg.__version__)"
-rm -rf "$TMP_DIR"
 ```
 
 Use `uv` for this installability check even if the host shell does not expose a direct
@@ -416,6 +415,8 @@ if "$TMP_DIR/py312/bin/pip" install --no-cache-dir "ftllexengine==X.Y.Z"; then
   echo "Unexpected Python 3.12 install success"
   exit 1
 fi
+
+rm -rf "$TMP_DIR"
 ```
 
 The release is not complete until the release object, assets, and real install test all succeed.

tests/test_documentation_tooling.py

@@ -562,6 +562,17 @@ def test_release_protocol_requires_annotated_tags_and_documents_prepublication_r
     assert "the same intended release commit you already verified in Step 5" not in text
 
 
+def test_release_protocol_keeps_public_verification_workspace_until_after_floor_check() -> None:
+    """The release verifier must not delete its temp workspace before the negative floor check runs."""
+    text = (REPO_ROOT / "docs" / "RELEASE_PROTOCOL.md").read_text(encoding="utf-8")
+
+    py313_install = text.index('uv venv --python 3.13 --seed "$TMP_DIR/py313"')
+    py312_install = text.index('uv venv --python 3.12 --seed "$TMP_DIR/py312"')
+    cleanup = text.index('rm -rf "$TMP_DIR"')
+
+    assert py313_install < py312_install < cleanup
+
+
 def test_atheris_inventory_readme_matches_target_manifest() -> None:
     """The published Atheris inventory should stay aligned with the live target registry."""
     readme = (REPO_ROOT / "fuzz_atheris" / "README.md").read_text(encoding="utf-8")