fix(ci): create release tag inline to bypass docker-action ownership issue

[Copilot]

Problem

The release workflow has been failing for v0.7.43 (and likely the two prior attempts on 2026-05-09) with:

Error: A branch or tag with the name 'v0.7.43' could not be found

…in the Build Release Package job's checkout step (run 25604887285).

Root cause

The real failure is in the upstream Prepare Release job. After the prepare job was moved to run inside the cypress/browsers container, stefanzweifel/git-auto-commit-action (a Docker action) fails silently. From the actual job log for step 11:

Started: bash /__w/_actions/stefanzweifel/git-auto-commit-action/.../entrypoint.sh
INPUT_REPOSITORY value: .
fatal: detected dubious ownership in repository at '/__w/blacktrigram/blacktrigram'
To add an exception for this directory, call:
    git config --global --add safe.directory /__w/blacktrigram/blacktrigram
...
Working tree clean. Nothing to commit.

The Docker action launches its own container and does not inherit the host job's safe.directory git config. git status errors out, and with the default skip_dirty_check: false the action interprets the failure as "no changes" and exits successfully without committing, tagging, or pushing. The version bump never lands on main and the tag is never created — so the downstream build job's actions/checkout with ref: ${{ github.event.inputs.version }} cannot find it.

This started failing once the prepare job adopted the cypress/browsers container (commit 8a1b52e9fa); prior runs on the bare ubuntu-latest runner did not hit this because file ownership matched the runner UID.

Fix

Replace stefanzweifel/git-auto-commit-action with an inline git commit + tag + push step that runs in the container's own shell, where we can set safe.directory for the actual UID running git. git is already installed in the container (line 80 of the workflow).

The new step:

• Adds safe.directory for $GITHUB_WORKSPACE
• Configures the same github-actions[bot] identity used previously
• Commits the version bump (idempotent — skips if git diff --cached --quiet)
• Creates the annotated tag (idempotent — skips if tag exists)
• Pushes HEAD to the dispatching branch (HEAD:${GITHUB_REF_NAME}) — needed because actions/checkout leaves the repo in a detached-HEAD state — and pushes the tag

A code comment explains why we bypass the Docker action so this isn't accidentally reverted.

Validation

• YAML validated with yaml.safe_load ✅
• parallel_validation (Code Review + CodeQL Security Scan) — no findings ✅

Notes / follow-ups

• The first push of v0.7.43 should now succeed via this fix on the next workflow_dispatch.
• The workflow already has permissions: contents: write on the prepare job, so the default GITHUB_TOKEN from actions/checkout can push the commit and tag.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

• .github/workflows/release.yml

[github-actions]

📸 Automated UI Screenshots

📋 Screenshots Captured (8)

#	Screenshot
1	01-splash-screen.png - 01 splash screen.png
2	02-intro-screen-menu.png - 02 intro screen menu.png
3	03-intro-screen-archetype-selector.png - 03 intro screen archetype selector.png
4	04-controls-screen.png - 04 controls screen.png
5	05-philosophy-screen.png - 05 philosophy screen.png
6	06-training-screen.png - 06 training screen.png
7	07-combat-screen-practice.png - 07 combat screen practice.png
8	08-combat-screen-versus.png - 08 combat screen versus.png

📦 Download Screenshots

📥 Download all screenshots from workflow artifacts

Screenshots are preserved as workflow artifacts for 30 days.

---

🤖 Generated by Playwright automation

[Copilot]

Pull request overview

Updates the release GitHub Actions workflow to reliably commit the version bump and create/push the release tag when running inside the cypress/browsers container (avoiding the “dubious ownership” failure mode of a Docker-based auto-commit action).

Changes:

• Replace stefanzweifel/git-auto-commit-action with inline git commands that set safe.directory, commit the version bump, create an annotated tag, and push commit+tag.
• Add an explanatory workflow comment documenting why the Docker action is intentionally avoided in this container job.