Switch to PR-based release flow

[colinrozzi]

Summary

• nix run .#release -- patch now creates a release PR instead of pushing tags directly
• Publish workflow triggers on merge to main when Cargo.toml version changes
• CI detects version bump, runs tests, publishes all crates in order, creates git tag + GitHub release
• Works with branch protection (no direct push to main needed)

Release flow

nix run .#release -- patch    # bumps 0.4.0 -> 0.4.1, creates PR
                               # review + merge
                               # CI: detect version change -> test -> publish -> tag -> release

Test plan

• nix flake check passes

🤖 Generated with Claude Code