ci: automate action releases

[chaptersix]

Summary

• add a manually dispatched release workflow that runs only from main, publishes an immutable semantic release, and advances the compatible major tag
• make release publication retry-safe: an existing immutable tag is accepted only when it resolves to the dispatched commit, and an existing GitHub Release is reused
• use the Temporal Data Git identity for annotated release tags
• extract bundle freshness, linting, formatting, and Linux/macOS/Windows action smoke tests into a reusable workflow shared by Validate and Release
• add a maintainer release guide and link it from the README
• retain @actions/tool-cache v2 until the dependency-update PR can move the generated bundle to ESM safely

Validation

• npm ci
• npm run lint
• npm run format:check
• npm run build with no dist/setup-temporal diff
• YAML parsing for the workflow files
• git diff --check

Stack

Base PR. Merge this first.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 939173faf6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chaptersix]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4c0af99486

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Publish an existing draft before advancing the major tag

When a draft release already exists for $VERSION, gh release view succeeds, so this branch skips creation and the workflow advances the compatible major tag and finishes successfully even though no published immutable release exists. I checked gh 2.96.0: gh release view --help exposes the isDraft field, gh release create --help states that immutability applies only after publication, and gh release edit --help documents --draft=false for publishing an existing draft. Inspect the existing release state and publish or reject drafts before moving the major tag.

Useful? React with 👍 / 👎.