release-flow.yml: tag-merged-release regex doesn't match squash-merge format with ' (#nnn)' suffix

[avihut]

Symptom

#545 was merged via GitHub's default squash-merge UI. The resulting master commit subject is:

```
chore: release v1.14.2 (#545)
```

`release-flow.yml`'s `tag-merged-release` job runs:

```bash
if [[ "$FIRST_LINE" =~ ^chore:\ release\ (v[0-9]+.[0-9]+.[0-9]+([.-][0-9A-Za-z.-]+)?)$ ]]; then
```

The trailing `$` anchor requires the line to end immediately after the version. GitHub's squash-merge appends ` (#nnn)` to the title by default, so the match fails:

```
HEAD commit subject: chore: release v1.14.2 (#545)
Not a release commit, nothing to tag
```

Result: v1.14.2 tag was not pushed automatically; manually tagged 577eafa and pushed v1.14.2 to unblock cargo-dist.

Root cause

I anchored the regex assuming squash commits would carry the PR title verbatim. They don't — GitHub appends the PR number. The PR-#547 reviewer surfaced this exact class of foot-gun ("don't edit the squash subject when merging"), but missed that GitHub itself edits it.

Fix

Allow an optional ` (#nnn)` suffix in the regex:

```bash
if [[ "$FIRST_LINE" =~ ^chore:\ release\ (v[0-9]+.[0-9]+.[0-9]+([.-][0-9A-Za-z.-]+)?)( (#[0-9]+))?$ ]]; then
```

The capture group for the version stays at `${BASH_REMATCH[1]}`; the new optional suffix is just there to satisfy the anchor.