ci(openclaw-plugin): push release tag only, not protected main

MemTensor/MemOS main requires PR + status checks; pushing HEAD fails.
npm publish already uses the runner workspace; tag records the release commit.

Author: jiachengzhen

.github/workflows/openclaw-plugin-publish.yml

@@ -117,4 +117,5 @@ jobs:
             git commit -m "release: openclaw-plugin v${{ inputs.version }}"
           fi
           git tag "openclaw-plugin-v${{ inputs.version }}"
-          git push origin HEAD --tags
+          # main is branch-protected on MemTensor/MemOS — push only the release tag, not HEAD
+          git push origin "refs/tags/openclaw-plugin-v${{ inputs.version }}"