ci: isolate release publishing permissions

[eoinest]

Summary

• separate routine Changesets release-PR maintenance from package publishing
• publish only after a same-repository bot release PR is merged by Ernest, Brian, or Archie
• remove general-purpose manual publishing and recover only by rerunning the exact authenticated release event
• allow collision recovery only when an earlier attempt of that same run reached npm publishing

Testing

• pnpm install
• pnpm exec oxfmt --check .github/workflows/release.yml
• actionlint .github/workflows/*.yml
• parsed the workflow as YAML and asserted trigger, permission, and merger invariants
• exercised validator success, first-attempt collision rejection, pre-publish retry rejection, and partial-publish retry recovery fixtures
• exercised current-version and stale-version binary recovery fixtures for gt and gtx-cli
• git diff --check

Notes

• No changeset is needed because this only changes CI configuration.
• The GitHub release environment is now restricted to the main branch.
• After this PR merges, add Ernest, Brian, and Archie as environment reviewers before merging any Changesets release PR. Staging that approval rule avoids pausing today's combined release-PR job.
• ci: verify release pull request provenance #2101 adds GitHub-signed release-PR provenance and accurate generated instructions as a separate child PR.

Greptile Summary

The release workflow now allows a rerun to continue after an earlier attempt reached package publishing, so it can recover a missing CLI binary release. The previously reported recovery failure was disproved by exercising the rerun path: the workflow reached the binary check and selected the missing binary for release.

Confidence Score: 5/5

No blocking failure remains.

The exercised recovery path continues after an earlier package-publishing attempt and correctly enables the missing binary release.

T-Rex Logs

What T-Rex did

• T-Rex completed the requested general contract validation verification, but local artifact references were not uploaded.

_{Ran code and verified through T-Rex}

_{Reviews (4): Last reviewed commit: "fix(ci): fail closed during release reco..." | Re-trigger Greptile}

[github-actions]

size-limit report 📦

Path	Size
generaltranslation	18.09 KB (0%)
generaltranslation/runtime	14.87 KB (0%)
generaltranslation/id	2.55 KB (0%)
generaltranslation/internal	7.34 KB (0%)
generaltranslation/types	115 B (0%)
generaltranslation/errors	81 B (0%)
@generaltranslation/format	9.5 KB (0%)
@generaltranslation/format/types	89 B (0%)
@generaltranslation/format/internal	880 B (0%)
gt-i18n	11.88 KB (0%)
gt-i18n/types	13 B (0%)
gt-i18n/internal	22.46 KB (0%)
gt-i18n/internal/types	13 B (0%)
@generaltranslation/react-core/pure	25.76 KB (0%)
@generaltranslation/react-core/hooks	20.66 KB (0%)
@generaltranslation/react-core/components	22.96 KB (0%)
@generaltranslation/react-core/components-rsc	26.41 KB (0%)
gt-react (client)	32.08 KB (0%)
gt-react (rsc)	28.86 KB (0%)
gt-react (server)	31.88 KB (0%)
gt-react/macros	8.81 KB (0%)
gt-next (client)	43.98 KB (0%)
gt-next (rsc)	48.12 KB (0%)
gt-next (server)	44.27 KB (0%)
gt-next/config	270.01 KB (0%)
gt-next/server	46.75 KB (0%)
gt-next/middleware	36.8 KB (0%)
gt-next/link	42.86 KB (0%)
gt-next/internal/_dictionary	144 B (0%)
gt-next/internal/_load-translations	144 B (0%)
gt-next/internal/_load-dictionary	144 B (0%)
gt-next/internal/_getLocale	125 B (0%)
gt-next/internal/_getRegion	122 B (0%)
gt-node	23.48 KB (0%)
gt-node/types	219 B (0%)
gt-node/internal	13.45 KB (0%)
gt-tanstack-start (client)	31.86 KB (0%)
gt-tanstack-start (server)	32.29 KB (0%)
gt-tanstack-start/server	10.24 KB (0%)
gt-react-native	30.29 KB (0%)
gt-react-native/plugin	4.6 KB (0%)
gt-react-native/internal	746 B (0%)

[eoinest]

@greptileai Please perform another review of the current PR head. During that review, resolve your own prior review threads when the issue is fixed or no longer applies. Do not resolve threads created by other reviewers.

[eoinest]

@greptileai Please perform another review of the current PR head. During that review, resolve your own prior review threads when the issue is fixed or no longer applies. Do not resolve threads created by other reviewers.

[eoinest]

Closing this pull request automatically because it has been open for more than 14 days. Reopen it if the work is still active, and add the keep-open label to exempt it from this weekly cleanup.