ci: release via tags only (no push to main)

.github/workflows/publish.yml

@@ -1,7 +1,7 @@
 name: Publish
 
 # On important source changes to main: auto-bump patch version + CHANGELOG,
-# commit chore(release), tag, and publish. Skip with [skip release].
+# bump version in-runner, tag (no push to main — branch protection), publish. Skip with [skip release].
 on:
   workflow_dispatch:
   push:
@@ -99,8 +99,9 @@ jobs:
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git add pyproject.toml src/praxicraft/__init__.py CHANGELOG.md
           if ! git diff --cached --quiet; then
+            # Local commit only — do not push to main (rules require PRs).
+            # Pushing the annotated tag keeps this release commit reachable.
             git commit -m "chore(release): ${TAG}"
-            git push origin HEAD:main
           fi
           {
             echo "version=${VERSION}"

RELEASING.md

@@ -53,6 +53,8 @@ You can run **Actions → Publish → Run workflow** manually (`workflow_dispatc
 
 ## Auto-bump
 
-Pushes to `main` that change package source auto-bump the patch version, update `CHANGELOG.md`, commit `chore(release): vX.Y.Z`, tag, create a **GitHub Release**, and publish to the language registry when credentials are configured.
+Pushes to `main` that change package source auto-bump the patch version and `CHANGELOG.md` in the runner, create a local `chore(release)` commit, and **push only the annotated tag** (not `main` — branch protection requires PRs). The tag retains the release commit. Then CI creates a **GitHub Release** and publishes to the language registry when credentials are configured.
+
+Version files on `main` may lag until a follow-up PR syncs them; published artifacts always use the tagged version.
 
 Skip with `[skip release]` in the commit message.