Publish to OpenUPM as part of the release workflow

[jsantelys-as]

Summary

Wires OpenUPM publishing into the release pipeline so a version tag both cuts
the GitHub Release and publishes the package to OpenUPM, and documents the flow.

Changes

• .github/workflows/release.yml: after creating the GitHub Release, the
  job now publishes to OpenUPM via openupm/openupm-action@v1, keyed off the
  pushed tag. Adds id-token: write so the action's OIDC flow works without an
  OpenUPM token or repository secret.
• .openupm/package-metadata.yml: converted to a reference copy of the
  registered listing (the authoritative file lives in openupm/openupm), with
  updated description, topics, cover image, hunter, and Git tracking mode.
• RELEASING.md: documents the OpenUPM scan/wait step, the OIDC-based
  action (no secret required), where to update authoritative listing metadata,
  and the stable-tag policy.

Notes

• The package is already registered with OpenUPM in Git tracking mode; OpenUPM
  builds each version with npm pack on the matching Git tag rather than the
  ZIP attached to the GitHub Release.
• The release workflow intentionally accepts bare stable tags (e.g. 1.0.1);
  supporting prereleases requires updating both package.json and the tag
  filter so the parsed tag version stays an exact match.

[coderabbitai]

📝 Walkthrough

Walkthrough

The release workflow now publishes com.appstack.unity-sdk to OpenUPM using the GitHub tag and OIDC. OpenUPM metadata and release-maintainer documentation were updated to describe tracking, validation, metadata ownership, and prerelease requirements.

Changes

OpenUPM release publishing

Layer / File(s)	Summary
OpenUPM workflow and package metadata .github/workflows/release.yml, .openupm/package-metadata.yml	The release job receives id-token: write permission and publishes the package through openupm/openupm-action@v1; OpenUPM metadata fields, topics, and reference instructions are updated.
Release procedure documentation RELEASING.md	Release instructions document OpenUPM scanning, tag-based npm pack builds, OIDC publishing, authoritative metadata, and prerelease version matching.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant GitHubRelease
  participant OpenUPM
  GitHubActions->>GitHubRelease: create and package tagged release
  GitHubActions->>OpenUPM: publish com.appstack.unity-sdk with github.ref_name
  OpenUPM-->>GitHubActions: report scan and installability status

Loading

Suggested reviewers: tomredlev-as

Poem

A rabbit tags the release with glee,
Then hops it toward OpenUPM’s tree.
OIDC unlocks the publishing door,
Metadata guides the package more.
“Build and install!” the bunny sings,
While docs explain the helpful things.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly describes the main change: adding OpenUPM publishing to the release workflow.
Description check	✅ Passed	The description is directly related to the changes and accurately summarizes the workflow, metadata, and documentation updates.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/jsantelys/add-publish-workflow

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch feat/jsantelys/add-publish-workflow

---

_{Comment @coderabbitai help to get the list of available commands.}