Release contract versions after connector-merged PRs

[RollNuts]

Summary

GitHub App-authored merges do not recursively trigger push workflows. Add a safe pull_request_target: closed path so a merged PR can release the version already present on the default branch.

Safety

• runs only when the PR was actually merged;
• checks out main, never contributor code;
• reads the merged package/changelog version;
• creates only a missing tag and never moves an existing one;
• keeps the normal push trigger for ordinary main updates.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.