fix(release): stop merges from publishing, filter prerelease tags, gate manual update in dev builds

.github/workflows/release.yml

@@ -1,12 +1,11 @@
 name: release
 
+# Releases are cut deliberately, never as a side effect of merging. A push to
+# main used to publish whenever it touched src/** or installer/**, which meant
+# every merged PR consumed a version and shipped an installer. Publishing now
+# requires an explicit act: push a v*.*.* tag, or run the workflow by hand.
 on:
   push:
-    branches: [main]
-    paths:
-      - 'src/**'
-      - 'installer/**'
-      - '.github/workflows/release.yml'
     tags: ['v*.*.*']
   workflow_dispatch:
     inputs:
@@ -47,7 +46,11 @@ jobs:
             $v = $manual
             $createTag = $true
           } else {
-            $latest = (git tag --list 'v*.*.*' --sort=-v:refname | Select-Object -First 1)
+            # Stable tags only. The 'v*.*.*' glob also matches prerelease tags
+            # like v0.1.65-beta.1, and $parts[2] would then be "65-beta", which
+            # [int] throws on -- failing the release. dev-build.yml has always
+            # filtered these out; release.yml did not.
+            $latest = (git tag --list 'v*.*.*' --sort=-v:refname | Where-Object { $_ -notmatch '-' } | Select-Object -First 1)
             if ([string]::IsNullOrWhiteSpace($latest)) { $latest = 'v0.0.0' }
             $parts = ($latest -replace '^v','').Split('.')
             $patch = [int]$parts[2] + 1

src/GamerGuardian/UI/SettingsWindow.xaml.cs

@@ -1027,6 +1027,22 @@ private void OpenChangeLogButton_Click(object sender, RoutedEventArgs e)
 
     private async void CheckUpdatesNowButton_Click(object sender, RoutedEventArgs e)
     {
+        // Dev builds must never self-update. The startup check has always been
+        // gated on this (App.OnStartup), but this manual path was not: clicking
+        // "Check now" in a dev build would download the newest *stable* installer
+        // and launch it over the running dev build. Same guard, both paths.
+        if (App.IsDevBuild())
+        {
+            System.Windows.MessageBox.Show(
+                this,
+                $"This is a development build (v{UpdateService.CurrentSemver()}). "
+                + "Automatic updates are disabled so it can't replace itself with a release build.",
+                "GamerGuardian",
+                System.Windows.MessageBoxButton.OK,
+                System.Windows.MessageBoxImage.Information);
+            return;
+        }
+
         var btn = CheckUpdatesNowButton;
         var prev = btn.Content;
         btn.IsEnabled = false;