Release v3.2.0

feat(ENG-14534): pin the CLI version and release on each CLI bump (#49)

* feat(ENG-14534): pin the CLI version and release on each CLI bump

Pin the default cli-version to Cloudsmith CLI 1.27.0, so that a workflow
that pins the action to a SHA always installs the same CLI. An explicit
cli-version, including latest, still overrides the pin.

Add scripts/bump-cli-version.sh. The cloudsmith-cli release workflow runs
it as cloudsmith-bot to pin each new CLI version and add a CHANGELOG
release section.

The Release workflow now runs when CHANGELOG.md changes on master. If the
newest CHANGELOG version has no tag, it runs the test matrix, then creates
the tag and release and moves the major tag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(ENG-14534): keep queued releases and never pin an older CLI

Keep every queued Release run with queue: max, so that each CHANGELOG
version gets its tag. Skip the release creation when the release exists,
so that a re-run of a failed job can still move the major tag. Make
bump-cli-version.sh skip a CLI version older than the pinned version.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: pin initial action release to CLI 1.29.0

* feat(ENG-14534): open the CLI bump pull request from this repository

Add the Bump Cloudsmith CLI workflow. It runs on the
cloudsmith-cli-release event that each CLI release sends, or by hand
with a version. It runs scripts/bump-cli-version.sh through the
open-cli-bump-pr action of the CLI repository, which opens or updates
the pull request from cloudsmith-bot.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(ENG-14534): pin CLI 1.30.0 and the merged open-cli-bump-pr action

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Bartosz Blizniak <bblizniak@cloudsmith.io>