ci: make release workflow compatible with protected main

[Mesteriis]

Summary

Fix the release workflow so future releases work with a protected main branch.

What changed

• stop mutating package.json and package-lock.json inside the workflow
• stop committing and pushing release artifacts back to main
• release directly from the version already committed on main
• skip cleanly when the corresponding tag already exists
• keep quality gates and artifact verification before creating the tag/release

Why

The previous workflow always tried to prepare the next patch version and push it to main, which is incompatible with repository rules that require changes to go through a pull request.

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.