ci(release): add auto-merge PR and tag-on-main workflows

[jzills]

Summary

• Adds a merge job to release.yml that runs after a successful publish, opens a PR from the release branch into main, and enables auto-merge
• Adds a new tag.yml workflow that fires when a release/** PR is merged into main, creating the vX.Y.Z git tag on the resulting main commit

How it works

push release/vX.Y.Z
  → test → publish → open PR to main (auto-merge enabled)
    → pr.yml CI passes → PR auto-merges
      → tag.yml fires → vX.Y.Z tag created on main

Prerequisites

Enable Allow auto-merge in each repo: Settings → General → Pull Requests.

Test plan

• Enable "Allow auto-merge" in repo settings
• Push a release/v0.0.0-test branch and confirm the merge job opens a PR targeting main
• Confirm auto-merge banner appears on the PR
• After PR merges, confirm tag.yml creates the v0.0.0-test tag on main