ci: skip the R2 publish for non-tag builds instead of failing

[acamarata]

What happened

nclaw's Desktop Windows Build succeeded on main today — run 34888596818, the first green desktop build in weeks. Two seconds later publish-r2.yml fired on its workflow_run and went red:

::error::Resolved tag 'main' does not look like a version tag
         (expected vX.Y.Z...). Refusing to publish.

Why this is a bug

The refusal is correct — a branch build is not a release and must not be published to packages.nself.org. The exit code is not.

The upstream workflows (Desktop macOS Build, Desktop Windows Build, Sign Linux Artifacts) run on ordinary branch pushes as well as tags. So every successful non-tag desktop build now turns main red, and it will recur on each one, because those builds have only just started passing.

Refusing to publish something that was never publishable is not a failure.

Fix

Require the upstream run to be a tag build in the job's own if, so the job skips rather than starts and fails:

if: >-
  (github.event_name == 'workflow_dispatch') ||
  (github.event.workflow_run.conclusion == 'success' &&
   startsWith(github.event.workflow_run.head_branch, 'v'))

head_branch carries the tag name for a tag-triggered upstream run and the branch name otherwise — exactly the discriminator needed. The file's existing header comment already explains this subtlety; it just was not applied to the trigger condition.

This mirrors the convention linux-sign.yml documents at length for its own gate-open state: "a bare red X here reads as 'something is broken' when the real state is 'nothing to fix'".

Not weakened

The in-step Resolve and validate release version check stays exactly as it is. It still catches a malformed workflow_dispatch input such as 1.4.0, which the job-level condition deliberately does not gate. Nothing that could previously publish is now blocked, and nothing that was previously blocked can now publish.