fix(ci): gate release on CI success

Move release into ci.yml as a job with `needs: check` so
semantic-release only runs after all checks pass. Removes
duplicated test/check steps from the release job.

Author: connorads

.github/workflows/ci.yml

@@ -23,3 +23,22 @@ jobs:
       - run: pnpm run build:dist
       - run: pnpm run lint:publint
       - run: pnpm exec tsc --noEmit
+
+  release:
+    if: github.ref == 'refs/heads/main'
+    needs: check
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: jdx/mise-action@v3
+      - run: pnpm install
+      - run: npx semantic-release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -72,7 +72,7 @@ Commits must follow [Conventional Commits](https://www.conventionalcommits.org/)
 - Transpiles to JS via tsdown: `bin` → `dist/cli.mjs`, `exports` → `dist/*.mjs` + `dist/*.d.mts`
 - `files` array controls what's published: `dist/`, `styles/`, `src/pwa/icons/`, `README.md`, `CHANGELOG.md`, `LICENSE`
 - CI: `.github/workflows/ci.yml` — pnpm test + biome check
-- Release: `.github/workflows/release.yml` — semantic-release on push to main
+- Release: `release` job in `.github/workflows/ci.yml` — semantic-release on push to main, gated on `check` job
   - Versioning, changelog, npm publish, and GitHub Release are all automated
   - `npx semantic-release --dry-run` for local verification
   - Release triggers: `feat:` → minor, `fix:` → patch, `BREAKING CHANGE` → major