ci: automate release sync fallback

[cafitac]

Summary

• add protected-main fallback to auto-release so a rejected metadata write-back opens a release-sync PR instead of requiring manual branch creation
• add release-sync follow-up job that tags the merged [skip release] release commit and dispatches publish when the tag is missing
• document the protected-main release path and refresh the handoff

Tests

• uv run pytest tests/test_release_workflows.py tests/test_published_install_smoke.py -q
• uv run pytest tests/ -q
• uv run python scripts/check_release_metadata.py
• uv run python scripts/smoke_release_readiness.py
• npm pack --dry-run
• git diff --check
• node --check bin/agent-memory.js
• static diff secret scan: finding_count: 0

Live verification plan after merge

1. Confirm auto-release attempts v0.1.32 metadata bump.
2. If protected main rejects the direct push, confirm it opens release-sync/v0.1.32 PR automatically.
3. Merge the release-sync PR.
4. Confirm the release-sync follow-up job creates tag v0.1.32 and dispatches publish.yml.
5. Verify GitHub Release, npm, PyPI, and published-install-smoke artifact.