ci(release): publish every successful main commit

[sriaradhyula]

Summary

• trigger the release workflow after the full main CI workflow succeeds
• serialize tag calculation so simultaneous merges cannot select the same patch version
• create an annotated semantic-version tag on the exact main commit
• stamp the resolved version into compiled binaries and npm packages
• preserve manually pushed stable and prerelease tags
• reuse an existing commit tag on reruns

Release behavior

The first automatic tag will be 0.2.22, continuing after the existing 0.2.21 tag. Each subsequent successful main commit increments the patch version and publishes the existing checksummed, cosign-signed, multi-architecture GitHub and npm release.

This avoids release-only commits and does not rely on a tag pushed with GITHUB_TOKEN starting a second workflow.

Validation

• actionlint
• automatic tag calculation simulation (expected 0.2.22)
• bunx tsc --noEmit
• bun run lint (passes with 18 existing warnings)
• bun run test (222 tests)

Related: #44