[simonchrz]

Closes #532.

Adds monthly-release.yml, which runs at 06:00 UTC on the 1st and can be started by hand. It tags the next patch version and starts release.yml and publish.yml on the tag when:

• something has merged since the last vX.Y.Z tag,
• every check on main's HEAD finished green,
• no pull request labelled breaking was merged since that tag.

Otherwise it logs why it skipped. A tag created with GITHUB_TOKEN doesn't start other workflows, so the release workflows are dispatched on the tag instead. release.yml gets workflow_dispatch for that, and only runs on a tag ref. No new secret.

Dry run first. Scheduled runs only log what they would release until the repository variable MONTHLY_RELEASE is true. Manual runs default to a dry run.

Answers to the open questions in #532, as defaults that are easy to change:

• "Green" means every check on the commit, leaving out the run itself.
• Months with only Dependabot bumps get a release, since those are often security fixes.
• workflow_dispatch instead of a GitHub App token.
• The breaking label doesn't exist yet and needs to be created. CONTRIBUTING.md now says when to use it.

Tested locally against this repo: the decision step picks v0.10.1 for current main, and skips when checks aren't green. The breaking-label search was checked against past merges. actionlint and zizmor report nothing.

[andrew]

One thing to follow up on: in monthly-release.yml the green check passes when main's HEAD has no check runs at all, since bad is just empty. A [skip ci] commit at HEAD would get tagged and published untested. Requiring at least one completed successful test/lint run before tagging would close that.