Support release/v publish automation

[ThomasK33]

Summary

• Teach publish.yml to run after merged PRs from release/v* branches.
• Create the matching v${package.version} tag from the merge commit before publishing.
• Keep direct tag pushes and manual dispatch as recovery paths.
• Document the protected-main release flow in the README.

Validation

• mise tasks validate --errors-only
• workflow YAML parse via Ruby
• npm run build
• npm test
• GITHUB_REF_TYPE=tag GITHUB_REF_NAME=v0.1.0-beta.0 mise run publish-dry-run
• release branch mismatch guard checked with RELEASE_BRANCH_NAME=release/v0.1.0-beta.1 against current 0.1.0-beta.0 package version