chore: make stable release manual-dispatch only

[mikasenghaas]

Summary

• Remove the vX.Y.Z tag push trigger from the Publish verifiers workflow — pushing release tags is not permitted, so stable releases are now cut only via workflow_dispatch with an existing tag.
• Simplify the build-tag job accordingly: single dispatch-only checkout, and the tag resolution step reads inputs.tag directly (dropping the now-dead push-ref branch).
• The main-branch dev pre-release path (build-dev / publish-dev) is unchanged.

Breaking

• Pushing a vX.Y.Z tag no longer triggers a PyPI publish or GitHub release. To cut a stable release, run the Publish verifiers workflow via workflow_dispatch with the existing tag as input.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes how production PyPI/GitHub releases are triggered; teams that relied on pushing vX.Y.Z tags must switch to manual workflow dispatch or releases will not ship.

Overview
Stable verifiers releases no longer run on tag push — only Publish verifiers via workflow_dispatch with an existing vX.Y.Z tag publishes to PyPI and creates the GitHub release (aligned with tag pushes not being allowed).

The on.push.tags trigger is removed from publish-verifiers.yml. The build-tag job is gated to dispatch only, uses a single checkout of refs/tags/${{ inputs.tag }}, and resolves the release tag from inputs.tag instead of branching on push vs dispatch.

Unchanged: pushes to main still drive dev pre-releases (build-dev / publish-dev).

^{Reviewed by Cursor Bugbot for commit 049c396. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Restrict stable release workflow to manual dispatch only

• Removes the vX.Y.Z tag-push trigger from publish-verifiers.yml; stable releases now require an explicit workflow_dispatch with a tag input.
• Simplifies the build-tag job by removing tag-push event logic and always checking out refs/tags/${{ inputs.tag }}.
• Behavioral Change: pushing a vX.Y.Z tag no longer triggers a stable release; the workflow will fail if inputs.tag is absent or does not match vX.Y.Z.

^{Macroscope summarized 049c396.}

[macroscopeapp]

Approvability

Verdict: Approved

This PR makes a minor CI/CD workflow adjustment, removing automatic tag-push triggers for stable releases and requiring manual dispatch instead. The change is self-contained, doesn't affect runtime behavior, and simplifies the release process.

^{You can customize Macroscope's approvability policy. Learn more.}