ci: cut a GitHub release for every published version

[anglinb]

Why

The repo has no GitHub releases at all, and the last tag is 0.2.0. publish.yml only pushes to npm, so there's no tag for any published version and nowhere on GitHub to see what shipped. I cut 0.3.2 by hand; this makes the publish workflow do it from now on.

What

After the npm publish step, publish.yml runs scripts/github-release.ts, which:

• creates the release with the root package.json version as its tag. Tags stay bare semver (0.3.3) to match 0.2.0 and 0.3.2. It targets the commit being published.
• uses that version's section of CHANGELOG.md as the notes, plus npm links for each published package. The format matches the 0.3.2 release.
• marks it --latest, or --prerelease for a x.y.z-beta version.

It is guarded in three ways:

• It runs only on the push that bumps the version. The root version must differ from the first parent's. Merging an unbumped PR, or dispatching on main without a bump, never tags code that isn't what's on npm.
• It's idempotent. An existing release is left alone, so re-running a commit is safe.
• It doesn't fail after npm already has the version. A missing changelog section falls back to GitHub's generated notes with a workflow warning.

The job now needs contents: write, and checkout uses fetch-depth: 2 so the first parent is available. The script lives next to version.ts and publish.ts. --dry-run prints the notes without creating anything, and dispatching the workflow with dry_run passes that flag through.

Tested

• Dry run on main at 0ee074c, the 0.3.2 bump: prints the 0.3.2 notes and would create the release on that commit, marked latest. The output matches the release created by hand.
• Dry run on ba54c2b, whose parent has the same version: Version unchanged (0.3.1) — no release to cut.
• Real run on main, where 0.3.2 already exists: Release 0.3.2 already exists — skipping. Nothing was created; the repo still has 1 release.
• CI dry run: not possible before merge, because the Publish environment only deploys from main and rejected the branch dispatch. The first real run will be the next version bump, e.g. fix: make SDK startup survive hostile environments #19 as 0.3.3.

🌸 Shipped with Kanna — an open-source workspace for all your coding agents. Written by claude/opus[1m].