docs: document JSON Schema versioning and release tag pinning in releasing.md

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/72cdaa37-37d8-4564-937b-e5f2ee8eafc1

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Author: Copilot

docs/releasing.md

@@ -31,6 +31,7 @@ The workflow will:
 - Build and push Docker images to GHCR
 - Create Linux x64 and arm64 binaries
 - Create NPM tarball and checksums
+- Generate versioned JSON Schema files with the release tag embedded in their `$id` URLs
 - Publish the GitHub Release with auto-generated changelog
 
 ### 2. Verify Release
@@ -43,6 +44,7 @@ Once the workflow completes:
    - Linux arm64 binary (`awf-linux-arm64`)
    - NPM tarball (`awf.tgz`)
    - Checksums file (`checksums.txt`)
+   - JSON Schema files (`awf-config.schema.json`, `awf-config.v1.schema.json`)
    - Installation instructions with GHCR image references
 3. Go to **Packages** page (in repository)
 4. Verify Docker images are published:
@@ -61,6 +63,25 @@ Each release includes:
 - `awf-linux-arm64` - Linux arm64 standalone executable
 - `awf.tgz` - NPM package tarball (alternative installation method)
 - `checksums.txt` - SHA256 checksums for all files
+- `awf-config.schema.json` - AWF config JSON Schema (latest alias, same content as `awf-config.v1.schema.json`)
+- `awf-config.v1.schema.json` - AWF config JSON Schema, version 1 (stable versioned copy)
+
+### JSON Schema versioning
+
+Each release generates the schema with a `$id` URL that includes the release tag, creating a stable, pinnable reference:
+
+```
+https://github.com/github/gh-aw-firewall/releases/download/v0.23.1/awf-config.v1.schema.json
+```
+
+The unversioned `awf-config.schema.json` asset is a copy of the v1 schema for convenience. External consumers (e.g. the gh-aw compiler) should pin to the versioned URL or the stable raw URL:
+
+| Reference | URL |
+|-----------|-----|
+| Pinned to a specific release tag | `https://github.com/github/gh-aw-firewall/releases/download/<tag>/awf-config.v1.schema.json` |
+| Always-latest from `main` branch | `https://github.com/__raw/github/gh-aw-firewall/main/docs/awf-config.v1.schema.json` |
+
+**Schema version bumping:** The schema version (`"version": "1"` in the schema body) must be incremented whenever breaking changes are made to the config surface (removed fields, changed types, stricter constraints). Non-breaking additions do not require a version bump. When the version is bumped (e.g. from `1` → `2`), a new file `awf-config.v2.schema.json` should be introduced in `docs/` and `scripts/generate-schema.mjs` updated accordingly.
 
 ### GitHub Container Registry (GHCR)
 Docker images are published to `ghcr.io/github/gh-aw-firewall`: