fix(release): stop merges from publishing, filter prerelease tags, gate manual update in dev builds

Three independent release-plumbing fixes, none of them UI-overhaul work.

release.yml no longer fires on a push to main. It published on any push
touching src/** or installer/**, so merging a PR was indistinguishable from
cutting a release -- v0.1.62 through v0.1.64 all shipped that way as a side
effect of merging. Publishing now requires an explicit act: a pushed
v*.*.* tag or a manual workflow_dispatch. Both remain.

The version auto-bump now filters prerelease tags. The 'v*.*.*' glob also
matches v0.1.65-beta.1, and with no filter $parts[2] becomes "65-beta",
which [int] throws on -- a tagged prerelease would have broken every
subsequent release. dev-build.yml has always had this filter; release.yml
did not, despite the docs claiming both did.

The Settings "Check now" button no longer self-updates a dev build. The
startup check has always been gated on App.IsDevBuild(), but this manual
path was not: clicking it in a dev build downloaded the newest stable
installer and launched it over the running build. It now reports that
updates are disabled and returns. Shipping bug, independent of the beta
channel work.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: carterscode

.github/workflows/release.yml

@@ -1,12 +1,11 @@
 name: release
 
+# Releases are cut deliberately, never as a side effect of merging. A push to
+# main used to publish whenever it touched src/** or installer/**, which meant
+# every merged PR consumed a version and shipped an installer. Publishing now
+# requires an explicit act: push a v*.*.* tag, or run the workflow by hand.
 on:
   push:
-    branches: [main]
-    paths:
-      - 'src/**'
-      - 'installer/**'
-      - '.github/workflows/release.yml'
     tags: ['v*.*.*']
   workflow_dispatch:
     inputs:
@@ -47,7 +46,11 @@ jobs:
             $v = $manual
             $createTag = $true
           } else {
-            $latest = (git tag --list 'v*.*.*' --sort=-v:refname | Select-Object -First 1)
+            # Stable tags only. The 'v*.*.*' glob also matches prerelease tags
+            # like v0.1.65-beta.1, and $parts[2] would then be "65-beta", which
+            # [int] throws on -- failing the release. dev-build.yml has always
+            # filtered these out; release.yml did not.
+            $latest = (git tag --list 'v*.*.*' --sort=-v:refname | Where-Object { $_ -notmatch '-' } | Select-Object -First 1)
             if ([string]::IsNullOrWhiteSpace($latest)) { $latest = 'v0.0.0' }
             $parts = ($latest -replace '^v','').Split('.')
             $patch = [int]$parts[2] + 1

src/GamerGuardian/UI/SettingsWindow.xaml.cs

@@ -1027,6 +1027,22 @@ private void OpenChangeLogButton_Click(object sender, RoutedEventArgs e)
 
     private async void CheckUpdatesNowButton_Click(object sender, RoutedEventArgs e)
     {
+        // Dev builds must never self-update. The startup check has always been
+        // gated on this (App.OnStartup), but this manual path was not: clicking
+        // "Check now" in a dev build would download the newest *stable* installer
+        // and launch it over the running dev build. Same guard, both paths.
+        if (App.IsDevBuild())
+        {
+            System.Windows.MessageBox.Show(
+                this,
+                $"This is a development build (v{UpdateService.CurrentSemver()}). "
+                + "Automatic updates are disabled so it can't replace itself with a release build.",
+                "GamerGuardian",
+                System.Windows.MessageBoxButton.OK,
+                System.Windows.MessageBoxImage.Information);
+            return;
+        }
+
         var btn = CheckUpdatesNowButton;
         var prev = btn.Content;
         btn.IsEnabled = false;