- Add push tag trigger (v*)
- Keep release + manual dispatch
- Simplify version extraction
- Remove environment gating
- Harden shell script (set -euo pipefail)