The default GITHUB_TOKEN cannot trigger downstream workflows (GitHub
prevents the chain to avoid infinite loops). publish-tag's `git push
origin "$TAG"` therefore never fires release.yml's `push: tags:`
listener — observed on v0.1.0-dev.50, where the tag landed but the
Release object was missing until manually created.
Fold the Release creation into the publish-tag job using `gh release
create` with GH_TOKEN=secrets.GITHUB_TOKEN. Direct API calls work fine
with the default token; only the push→workflow chain is blocked.
- Idempotent: skips if release already exists.
- Notes: auto-generated from `git log $prev..$TAG` plus a Verification
block linking back to the CI run.
- Prerelease flag respects steps.version.outputs.prerelease (true for
dev/rc tags, false for vX.Y.Z final tags on main).
release.yml stays untouched as a fallback for manually-pushed tags
(humans pushing tags directly CAN trigger workflows).
Closes#186
james.maes