ci(publish): auto-promote to production after release-triggered staging publish

[xuyushun441-sys]

What

Wire production to auto-promote after a successful, release-triggered staging publish — closing the last manual step in the release flow.

Today: release: published → staging publishes (auto); production is manual dispatch only. This adds a workflow_run trigger to publish-production.yml:

on:
  workflow_dispatch: { ... }          # retained
  workflow_run:
    workflows: ['Publish to marketplace (staging)']
    types: [completed]

The job only runs the auto-promote path when all hold:

• upstream staging run conclusion == 'success'
• upstream staging run event == 'release' ← so manual staging dispatches & dry-runs never promote
• repo is canonical objectstack-ai/templates

Manual workflow_dispatch (template filter + dry-run) is unchanged. The auto path has no inputs → empty filter → publishes all templates (unchanged versions are idempotent 409 no-ops).

Resulting flow

Publish a GitHub Release
   └─▶ staging publish (auto, event=release)
          └─▶ on success ─▶ production publish (auto)   ← NEW

Notes

• Takes effect once merged to main (GitHub only fires workflow_run from the default branch).
• So v0.1.0 (already released) won't auto-promote; promote it via a manual production dispatch, or it's covered by the next Release.

🤖 Generated with Claude Code