chore(ci): trigger release workflow from pushes to main

[dustinbyrne]

💡 Motivation and Context

The release workflow was triggered by pull_request.closed, so protected release environments could be requested from a refs/pull/*/merge ref instead of refs/heads/main after a PR merged. That can cause environment protection to reject the release even though the PR landed on main.

This ports the CI release fix from PostHog/posthog-js#3461.

Changes

• Trigger automatic releases from push to main instead of pull_request.closed.
• Keep workflow_dispatch for manual releases.
• Add a resolve-release-context job that skips automated version-bump commits, finds the PR associated with the pushed commit, and only continues when the merged PR currently has the release label.
• Limit push-triggered releases to changeset paths where the repo uses changesets/Sampo changesets, so unrelated pushes do not queue behind the release concurrency group.
• For bump-label release workflows, resolve the bump type from the associated PR labels and scope release concurrency to the protected release job because there is no changeset path to filter on.

💚 How did you test it?

• Parsed .github/workflows/release.yml as YAML.
• Ran actionlint on .github/workflows/release.yml (ignoring the pre-existing actions/create-github-app-token@v3 client-id/app-id warning where that already exists in the workflow).
• Compared the workflow structure against the posthog-js reference PR: push trigger, release-context resolution, version-bump skip, release-label check, and gated release job.

📝 Checklist

• I reviewed the submitted code.
• I added tests to verify the changes.
• I updated the docs if needed.
• No breaking change or entry added to the changelog.

If releasing new changes

• Ran pnpm changeset to generate a changeset file
• Added the "release" label to the PR to indicate we're publishing new versions for the affected packages