ci: automated release, gated on CI passing on main

.github/workflows/release.yml

@@ -1,8 +1,15 @@
 name: Release
 
+# Runs automatically only AFTER the CI workflow succeeds on main, so a red
+# main never publishes. The changesets flow then takes over:
+#   1. add a changeset in your PR, merge to main
+#   2. CI passes -> this opens/updates a "Version Packages" PR
+#   3. merging THAT PR re-runs CI -> this publishes to npm
 on:
-  push:
+  workflow_run:
+    workflows: [CI]
     branches: [main]
+    types: [completed]
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
@@ -13,9 +20,13 @@ permissions:
 
 jobs:
   release:
+    # Only release when CI on a push to main actually passed.
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       # Installs Node and pnpm at the exact versions pinned in mise.toml.
       - name: Setup toolchain (mise)