fix(release): pr-based release flow so version bumps reach main

[Puppo]

Summary

The Release workflow's release-it --ci invocation was silently failing on the git push step because main's branch-protection rules require PRs, status checks, and a CodeQL scan. release-it swallowed the push error and reported ✔, leaving an orphan tag and an orphan GitHub Release: run 29652144213 published v0.0.5 to npm and tagged it on GitHub while main stayed at 0.0.4.

What's in this PR

• Delete .github/workflows/release.yml (the broken workflow).
• Add .github/workflows/release-pr.yml (Phase 1): bumps the version with the remote-touching steps disabled, pushes the release commit to release/vX.Y.Z, opens a PR, enables --auto --squash merge. Workflow exits without waiting.
• Add .github/workflows/release-publish.yml (Phase 2): triggered when a release PR is squash-merged into main. Retags the squash-merged commit (handles the stale local tag from release-it + force-updates any existing remote tag), publishes to npm via OIDC trusted publishing, and creates the GitHub Release with --generate-notes.
• Cleanup: the orphan v0.0.5 tag and the v0.0.5 GitHub Release were removed during this change (npm v0.0.5 stays as-is since it was already published).

New release-pr.yml inputs

• increment (default patch): pass minor (or major) the first time you release after this lands to skip past v0.0.5 on npm. Defaults to patch for normal usage.

Test plan

• (Negative path) Dispatch release-pr.yml, verify a release/v* branch and PR with the release label exist and auto-merge is enabled. Close the PR without merging; confirm release-publish.yml does not trigger.
• (Happy path) Dispatch again (use increment=minor for the first run), approve the PR (self-approval is allowed), wait for squash-merge. Verify:
  • main has the squash-merged version-bump commit.
  • release-publish.yml runs on pull_request: closed (merged).
  • Tag v* retargets to the merge commit and is pushed.
  • npm package appears at the new version.
  • GitHub Release v* exists with auto-generated notes.
• (Idempotency) Manually push a stale remote tag of the same name; rerun release-publish.yml; confirm the delete-and-retag pattern handles it.
• (CI) Confirm CI (12 checks), commitlint (PR title + commits), and CodeQL all run on the release PR and pass.

Assumptions

• Branch protection on main stays as is (1 squash-merge approval, 12 status checks, CodeQL scan).
• allow_auto_merge and allow_squash_merge already true on the repo.
• The dispatching actor can self-approve their own PR (no specific reviewer required).
• npm trusted publishing (OIDC) is configured for the production environment.