feat(release): fully automated release pipeline on main push

[choiyounggi]

What

Closes the remaining manual steps of the release chain. After this, any push to main auto-releases end to end:

merge to main
  -> auto-release.yml: next semver from conventional commits since the last tag
     (feat -> minor, type!/BREAKING CHANGE -> major, else patch),
     bumps .claude-plugin/{plugin,marketplace}.json, pushes the bump commit
  -> auto-tag.yml (existing): tag vX.Y.Z + GitHub Release
  -> NEW: dispatches groundwork sync-dev-loop-pin.yml immediately
     (hourly schedule remains the backstop)
  -> groundwork PR auto-merges -> installs receive the new version

Loop & race safety

• auto-release.sh prints skip: awaiting tag whenever plugin.json is ahead of the tags (the exact post-bump state), plus a job-level guard on chore(release) head commits.
• Back-to-back merges: a non-fast-forward bump push is logged as a benign supersede (the queued run for the newer push recomputes) instead of a failed run.
• Strict X.Y.Z validation (4-segment/empty-segment versions rejected — caught in independent review).

Requires (one-time)

RELEASE_AUTOMATION_TOKEN repo secret — fine-grained PAT (repos: dev-loop + groundwork; Contents R/W + Actions R/W). Without it the bump step fails loudly with setup instructions; nothing releases silently wrong. Set the secret before merging to avoid one red run.

Tests

tests/auto-release.bats: 15 cases (patch/minor/major, scope+bang, BREAKING body, highest-wins, both skip states, collision exit 1, malformed/4-segment/empty-segment versions, usage). Full suite green locally.

🤖 Generated with Claude Code

https://claude.ai/code/session_01B4zKA2wmVG1621R5ynC8uc