Document the develop-leads versioning policy

.github/copilot-instructions.md

@@ -57,6 +57,10 @@ This repository builds and publishes Docker images for Network Optix VMS product
 - Use explicit types (no `var`), Allman braces, file-scoped namespaces, and other conventions as defined in the master style guide.
 - Respect line endings and encoding rules from the repository configuration, including UTF-8 without BOM.
 
+## Versioning
+
+`develop` leads `main` by a minor. After a `develop -> main` release lands and main's publish completes, bump the minor in [version.json](../version.json) on `develop` via an isolated `bump-version-X.Y` PR, so develop's NBGV-computed release version (the GitHub release tag / `LABEL_VERSION`) sorts above main's last stable. A `develop -> main` promotion that carries only maintenance (dependency bumps, CI/doc fixes, template re-syncs) holds main's version instead - `git checkout main -- version.json` on the promotion branch. See [AGENTS.md "Versioning"](../AGENTS.md#versioning).
+
 ## GitHub Copilot Review Runbook
 
 Use this section for provider-specific mechanics. The expected review loop *contract* (request review on every push, verify head-SHA coverage, triage findings, reply + resolve, escalate when stuck) is defined in [AGENTS.md -> PR Review Etiquette](../AGENTS.md#pr-review-etiquette). This section only describes how to make GitHub Copilot reliably execute it.

AGENTS.md

@@ -59,6 +59,10 @@ For comprehensive coding and formatting standards, follow:
 - Merges to `main`/`develop` do not build or publish images. Auto-merged Dependabot and codegen PRs simply land commits that the next scheduled publish picks up. Do not reintroduce push-triggered publishing or full-matrix PR builds.
 - Lint workflow edits before pushing (see [Workspace and linting](#workspace-and-linting)); there is no CI lint job.
 
+## Versioning
+
+The `version` (major.minor) in [version.json](./version.json) is the version floor; NBGV computes the project `SemVer2` (`X.Y.<height>`, with a `-g<sha>` prerelease suffix off non-`main` refs). That NBGV version is the **GitHub release tag** on `main` and the `LABEL_VERSION` build arg baked into the images - distinct from the Docker image *tags*, which carry the Nx product version from `Make/Matrix.json`. **`develop` leads `main` by a minor:** after a `develop -> main` release lands and main's publish completes, bump the minor in `version.json` on `develop` in an isolated `bump-version-X.Y` PR, so develop's NBGV prereleases sort above main's last stable (at a shared `X.Y`, develop's prerelease `X.Y.<height>-g<sha>` sorts *below* main's stable `X.Y.<height>`). A **maintenance** `develop -> main` promotion (dependency bumps, CI/doc fixes, template re-syncs) holds main's version - `git checkout main -- version.json` on the promotion branch - so `main` advances only its height, not its minor.
+
 ## PR Review Etiquette
 
 The repo runs a review loop on every PR: local agent iteration plus remote automated review (GitHub Copilot is the configured reviewer). Treat this as a contract regardless of which local agent authored the changes.