ci: avoid pushing release commits to protected main

[ts-76]

Summary

• stop the release workflow from creating and pushing release commits to main
• create and push only a version tag from the already-merged main commit
• keep tag-triggered GitHub Release and npm trusted publishing flow intact

Why

The repository requires pull requests for changes to main, so changelogen --push fails after creating the tag. This changes the workflow to work with branch protection instead of fighting it.

Follow-up

• Remove the accidental remote tag �0.1.2
• Bump package.json version in a PR before the next release, since releases are now tagged from the merged main commit instead of creating a release commit on CI