feat: add string-token bump strategy

[ihabsoliman]

Adds bump_strategy: string-token as an alternative to conventional commits, for teams that mark release intent with magic substrings in commit messages (#major/#minor/#patch/#none by default) rather than structured commit headers.

Tag discovery, prefix scoping, prerelease handling and tag creation are shared with the conventional-commits path; only bump derivation differs. Three places do need their own behaviour under the new strategy, each mirroring anothrNick/github-tag-action, from which the token convention comes:

• The previous tag and commit-range base are always the latest stable tag. The prerelease tag is consulted separately, as a continue-or-restart switch. Incrementing from max(stable, prerelease) instead would turn tags 1.4.0 + 1.4.1-RC.3 with a #patch commit into 1.4.2-RC.0 rather than 1.4.1-RC.4.
• When no tag matches the prefix yet, the commit range is empty rather than "every commit reachable from HEAD", so the first tag of a new prefixed lineage cannot be decided by an unrelated historical token.
• The closed-PR payload fallback is bypassed, since the bash implementation has no equivalent and it would surface commits that a git log A..A range never sees.

A none token, or no token with default_bump: false, skips tagging but still echoes the existing stable tag into new_tag/new_version instead of leaving them empty.

Also adds pre_release, to force pre-release on or off explicitly rather than inferring it from branch regexes, and token_match_mode: word (default) requires delimited, case-insensitive tokens, while substring reproduces the legacy glob semantics under which #patches triggers #patch.

Existing conventional-commits callers are unaffected: bump_strategy defaults to conventional-commits and the whole feature is inert unless it is set.

fix: normalize push payload commits in the closed-PR fallback

getClosedPRCommits read commit.commit.message, but push webhook payload commits are { id, message, author } with no nested .commit, so it threw whenever it actually fired - on an empty compare range with a push payload present. The shape conversion was also a .filter where a .map was intended, which silently passed the original elements through. Existing tests missed both because their fixtures used the API-shaped { sha, commit: { message } }.