fix(release): stop merges from publishing, filter prerelease tags, gate manual update in dev builds

[carterscode]

Three independent release-plumbing fixes. None of them are UI-overhaul work — they are pulled out ahead of it so main is safe before the feature branch diverges further.

⚠️ Merging this cuts one final release

The trigger removal only takes effect after it lands. This PR touches both src/** and release.yml, so merging it fires release.yml one last time under the old rules and publishes v0.1.65. Every merge after that is silent.

That release is legitimate — it contains the user-facing fix in #3 below.

1. A push to main no longer publishes

release.yml fired on any push to main touching src/**, installer/**, or the workflow itself, which made merging a PR indistinguishable from cutting a release. v0.1.62, v0.1.63 and v0.1.64 all shipped as a side effect of merging.

 on:
   push:
-    branches: [main]
-    paths:
-      - 'src/**'
-      - 'installer/**'
-      - '.github/workflows/release.yml'
     tags: ['v*.*.*']
   workflow_dispatch:

Publishing now requires an explicit act: push a v*.*.* tag, or run the workflow by hand. Both paths are unchanged. paths: went with branches: — it existed only to narrow the branch trigger, and leaving a path filter on a tag-only trigger would be misleading.

2. The version auto-bump no longer breaks on a prerelease tag

The v*.*.* glob also matches v0.1.65-beta.1. With no filter, $parts[2] becomes "65-beta" and [int] throws — a single tagged prerelease would have broken every subsequent release.

-$latest = (git tag --list 'v*.*.*' --sort=-v:refname | Select-Object -First 1)
+$latest = (git tag --list 'v*.*.*' --sort=-v:refname | Where-Object { $_ -notmatch '-' } | Select-Object -First 1)

dev-build.yml has always had this filter. release.yml never did, despite the project docs claiming both did.

3. "Check now" no longer self-updates a dev build

CheckUpdatesNowButton_Click called UpdateService.CheckLatestAsync() with no guard. In a dev build, clicking it downloaded the newest stable installer and launched it over the running build — the exact self-replacement IsDevBuild() exists to prevent. The startup check has always been gated; this manual path was not.

It now reports that updates are disabled and returns before UpdateService is touched. No XAML change, no orphaned handler.

This is a live shipping bug, independent of the beta-channel work that prompted finding it.

Verification

Build clean (warnings-as-errors), full suite green — 631 tests.

🤖 Generated with Claude Code