fix(release): publish releasable main merges

[rianjs]

Outcome

Automatically tag release-worthy changes merged to main; the tag drives the existing Tauri/native release and package publication workflows.

Gates and versioning

• The pinned PR-title action accepts the full conventional grammar; only feat/fix titles and release paths (apps/**, crates/**, root Cargo files, packaging/**, scripts/**, and release workflows) create a release tag.
• Tags derive MAJOR.MINOR from the checked-in Tauri 0.3.0 baseline and use the workflow run number as PATCH (v0.3.1 on the first live run).
• Tag creation uses TAP_GITHUB_TOKEN, is same-SHA idempotent, fails on collisions, and manual auto-release dispatch is always dry-run.
• Release tags validate strict semver, release-line ancestry, and pass the tag version through Tauri's config override with native package metadata assertions.

Checks

node scripts/check-release.mjs, node scripts/check-docs.mjs, actionlint, Cargo fmt/clippy/tests, and desktop npm tests/lint/TypeScript/build pass.

Closes #56

[rianjs]

Major

• .github/workflows/auto-release.yml:31-41 validates only that Tauri's version is semver before it tags. It does not run scripts/check-release.mjs, even though that script is the only check enforcing the required .0 release-line baseline and the matching desktop Cargo/lockfile versions (scripts/check-release.mjs:32-37). CI runs those checks concurrently, not as a prerequisite. Consequently a fix: merge that changes tauri.conf.json to 0.3.1 (or leaves Cargo/lock mismatched) can push v0.3.<run> first; Release then rejects it in its contract step, leaving a bad permanent tag. Run the release contract before the gate/tag and assert that dependency in the contract check.

• scripts/check-release.mjs:43-56 checks that the auto-release action and tag-push strings exist, but never verifies that the Tag step is conditioned on steps.gate.outputs.should-release == 'true' (.github/workflows/auto-release.yml:55-56). Removing that condition would make non-release commits tag while every added assertion still passes. Add a step-scoped assertion for this if, so the promised feat/fix-and-path gate is actually regression-tested.

Minor

• The Windows "metadata" proof is only a filename substring check (.github/workflows/release.yml:256-260), and the contract test mirrors that weak assertion (scripts/check-release.mjs:140-141). Renaming a stale installer to include $VERSION passes without proving its embedded File/ProductVersion is tag-derived. Inspect the resulting EXE's VersionInfo (or another installer metadata source) and compare it exactly with $VERSION.

• Manual automatic-release dry runs still inject TAP_GITHUB_TOKEN into the step environment (.github/workflows/auto-release.yml:58-68) even though the first branch exits before any mutation and the token is never needed. Restrict that secret to push runs (and assert it) to preserve the stated safe-dry-run/least-privilege boundary.