ci(release): tag automatically, and publish a GitHub Release at all

Three changes, on this working branch rather than a separate one as requested. Only
these three files are staged — the in-progress addon edits are left alone.

1. release.yml delegates to the reusable workflow in fleetbase/fleetbase, which
   validates and pushes the tag when a dev-v* branch merges to main. The version is
   never retyped: it comes from the branch name, and the tag is refused unless
   composer.json, package.json, extension.json and RELEASE.md already agree with it.

2. create-release.yml is NEW. pallet was the only module without one, so tagging it
   published to npm and GitHub Packages and created no GitHub Release at all. Copied
   from the other modules, with body_path: RELEASE.md so the notes are the release
   body, matching fleetbase/fleetbase.

3. RELEASE.md is seeded, because the tag workflow refuses to release without notes
   whose first line names the version. Both placeholder markers must be replaced
   before a release will go through — that guard exists so the template itself can
   never be published as the release notes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: roncodes

.github/workflows/create-release.yml

@@ -0,0 +1,22 @@
+name: Create Release
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  create:
+    runs-on: ubuntu-latest
+    steps:
+        - uses: actions/checkout@v4
+        - name: Publish GitHub Release
+          uses: softprops/action-gh-release@v2
+          with:
+            tag_name: ${{ github.ref_name }}
+            name: ${{ github.ref_name }}
+            body_path: RELEASE.md
+            generate_release_notes: true
+            draft: false
+            prerelease: false
+          env:
+            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -0,0 +1,46 @@
+name: Release Tag
+
+# Tags a release when a `dev-v*` branch is merged to main, and pushes the tag. Delegates
+# to the reusable workflow in fleetbase/fleetbase. Requires org secret _GITHUB_AUTH_TOKEN
+# (inherited); no-ops with a warning until it is set.
+#
+# It pushes the tag and nothing else — create-release.yml and the publish jobs in this
+# repository already chain off `push: tags: v*`.
+#
+# The version is never retyped: it comes from the branch name, and the tag is refused
+# unless the files below and RELEASE.md already agree with it. This repository is
+# an ember addon plus a server, so it carries composer.json, package.json and extension.json.
+#
+# RELEASE.md is required, and its first line must name the version being released. That
+# check is the only thing that can tell notes written for this release from the previous
+# release's notes nobody replaced.
+#
+# Deliberately unpinned, like postman.yml — it tracks the reusable workflow on main, so
+# there is no ref here to remember to bump.
+#
+# workflow_dispatch is the recovery path. Use it when a release failed validation and the
+# fix landed on main after the merge: re-running the merge event would check out the
+# merge commit and never see that fix.
+
+on:
+  pull_request:
+    types: [closed]
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to tag, e.g. 1.2.3. Recovery only — a normal release reads it from the branch."
+        required: true
+permissions:
+  contents: read
+
+jobs:
+  tag:
+    if: github.event_name == 'workflow_dispatch' ||
+        (github.event.pull_request.merged == true &&
+         startsWith(github.event.pull_request.head.ref, 'dev-v'))
+    uses: fleetbase/fleetbase/.github/workflows/release-tag.yml@main
+    with:
+      version-files: composer.json,package.json,extension.json
+      version: ${{ github.event.inputs.version || '' }}
+    secrets: inherit

RELEASE.md

@@ -0,0 +1,15 @@
+> v0.0.2 ~ "RELEASE_NOTES_PLACEHOLDER — replace this line with the release title"
+
+---
+## Highlights
+
+RELEASE_NOTES_PLACEHOLDER
+
+Describe what changed in this release. The first line above must name the version
+being released, and both placeholder markers must be gone, or the release workflow
+refuses to tag.
+
+---
+## Need help?
+- [GitHub Discussions](https://github.com/fleetbase/fleetbase/discussions)
+- [Discord](https://discord.gg/HnTqQ6zAVn)