docs: define customer release branch policy

CONTRIBUTING.md

@@ -14,9 +14,26 @@ If you change architecture, deployment flow, or operational behavior, update the
 - `develop`: active integration branch
 - `main`: stable branch for production promotion
 - short-lived feature branches: branch from `develop`, merge back into `develop`
+- customer release branches: branch from `main` for a frozen customer line when a customer must not receive future feature work automatically
 
 Do not use `main` as the default development branch.
 
+### Customer release policy
+For customer-specific deliveries such as TUBCO, use a dedicated release branch from the current stable line.
+
+Recommended pattern:
+- `release/tubco-v1`: customer maintenance branch
+- `tubco-baseline-2026-03`: baseline tag taken from the same stable point
+
+Rule:
+- new product features continue on `develop`
+- customer release branches only receive approved:
+  - bug fixes
+  - security updates
+  - UI improvements
+
+Do not let a customer deployment track `develop` directly.
+
 ## Current Delivery Model
 - GitHub Actions is used for CI
 - the current test server is local/LAN-only