fix(ci): unbreak release workflow (workflow_dispatch was never registered)

[yurenju]

Why

The release workflow has been silently broken since it was added. In the Actions tab the workflow showed up as .github/workflows/release.yml (its raw path) instead of Release, every push produced a 0-second failure run with the message "This run likely failed because of a workflow file issue", and the manual Run workflow button was never functional — workflow_dispatch was never actually wired up.

Root cause

.github/workflows/release.yml line 53 was:

run: npm version ${{ inputs.bump }} -m "chore(release): %s"

The run: value is a YAML plain scalar (no surrounding quotes). The ): inside chore(release): %s is a colon + space, which terminates a plain scalar — the " characters around the message are just literal text in plain-scalar context, not string delimiters. js-yaml reports bad indentation of a mapping entry (53:63), and GitHub rejects the whole file at registration.

Changes

• Wrap the npm version command in a block scalar so the colon survives parsing.
• Replace if: ${{ inputs.dry_run != 'true' }} with if: ${{ !inputs.dry_run }} — the previous check compared a type: boolean input against the literal string 'true'.
• Add a Check spec drift step between sync-spec and generate. npm version requires a clean working tree, and a drifted spec/openapi.json would also publish something different from what is on main. Fail fast and ask the operator to commit the refreshed spec first.
• Add .gitattributes pinning *.yml / *.yaml to LF, and normalize the existing workflow files. CRLF in workflow YAML is a common silent-failure trap.

Verification

Local js-yaml parse now succeeds and surfaces the expected structure:

name: Release
triggers: [ 'workflow_dispatch' ]
steps: 13

How to test after merge

1. Go to Actions → Release → Run workflow — the button should now appear with bump (patch/minor/major) and dry_run inputs.
2. Run once with dry_run: true to confirm: npm publish --dry-run fires, and Push tag + GitHub release both skip.
3. Then run with dry_run: false for the real bump.

🤖 Generated with Claude Code