ci(security): route releases through protected main

[ctxswitch]

Summary

• create release bumps on a branch and open a pull request
• dispatch CI explicitly for release PRs created by GitHub Actions
• tag and publish releases only after the version bump reaches main
• make read-only permissions explicit for CI workflows

Why

The main branch ruleset requires pull requests and passing CI. GitHub's built-in Actions app cannot be granted a ruleset bypass on this personal repository, so release automation must follow the protected path instead of pushing directly to main.

Validation

• actionlint .github/workflows/*.yaml
• git diff --check origin/main...HEAD

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️