fix(ci): PR-based bump-release and repair v4 release pipeline

[EnmaJim]

Linked issue

Closes #393

Summary of changes

The scheduled Bump & Release workflow has failed 9 weeks straight because it pushed the
version commit + tag directly to protected main (GH006), and stale tags caused
tag already exists on re-runs. This reworks the pipeline to the PR-based flow and repairs
release.yml for the v4 (git-checkout + shim) layout.

bump-release.yml — no longer pushes to main:

• Opens a release/vX.Y.Z PR instead (branch push is allowed; only main is protected).
• Skips the scheduled run when nothing merged since the last tag; manual workflow_dispatch always bumps.
• Aborts if the target tag/branch already exists (guards the duplicate-tag failure).
• Promotes the CHANGELOG.md [Unreleased] block to a dated section and re-seeds a fresh scaffold.

release.yml — triggers on the merge and repairs the v4 build:

• Trigger is now push: main filtered to version.json (+ workflow_dispatch for manual re-cuts).
• Resolves the version from version.json; idempotency guard skips if the release/tag exists.
• Drops the dead pwsh install.ps1 test step; builds Studio UI from src/studio-ui.
• Deletes the retired PowerShell Gallery publish job.
• Release notes = promoted CHANGELOG block + v4 install footer, falling back to --generate-notes;
  gh release create --target $GITHUB_SHA creates the tag itself.

Resulting flow: bump PR opens → a maintainer approves + merges → the version.json change lands
on main → release.yml fires on that push and cuts vX.Y.Z. No direct push to main.

Testing notes

Post-merge, to validate on the real repo: workflow_dispatch Bump & Release → approve + merge the
PR → confirm Release & Publish fires on the version.json push and creates the release; re-run it
for the same version to confirm the idempotency guard skips.

Checklist

• Linked issue exists
• Follows the contribution guide
• Tests added or updated — N/A
• Docs updated (if behaviour changed)