fix(release): scope snap to snap-publish.yml + don't double-publish (#11)

Two issues surfaced on the v0.2.0 tag's first run:

1. snap-publish.yml's "Build snap" step failed because electron-builder
   detected the git tag and attempted an implicit publish to the Snap
   Store from inside the build job. SNAPCRAFT_STORE_CREDENTIALS is
   scoped to the dedicated publish-edge / publish-stable jobs only, so
   the build's keyring lookup failed and the workflow died before the
   snap was even uploaded as an artifact. Pass --publish never to the
   build step; the dedicated publish jobs use snapcore/action-publish
   with the credentials properly scoped.

2. release-linux's package step tried to build all three Linux targets
   from the electron-builder.yml (AppImage, deb, snap), which is
   redundant with snap-publish.yml AND triggers the same implicit-
   publish behaviour. Pass an explicit "AppImage deb" target list so
   this job only owns AppImage + deb. Snap is exclusively owned by
   snap-publish.yml.

(The release-linux run for v0.2.0 also showed an AppImage cache rename
race during the snap step — moot once snap is removed from this job.
The actual AppImage and deb artefacts uploaded successfully and are on
the v0.2.0 GitHub Release page; this commit just stops the spurious
failure.)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: JohnMcLear

.github/workflows/release.yml

@@ -21,7 +21,12 @@ jobs:
       - name: Build
         run: pnpm build
       - name: Package
-        run: pnpm exec electron-builder --linux --config build/electron-builder.yml --publish always
+        # Only AppImage + deb here. Snap is owned by snap-publish.yml
+        # (separate job, separate credentials). Without an explicit list,
+        # electron-builder reads the linux.target array in the YAML —
+        # which includes snap — and tries to publish a snap to the Snap
+        # Store from this job, which doesn't have the credentials.
+        run: pnpm exec electron-builder --linux AppImage deb --config build/electron-builder.yml --publish always
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - uses: actions/upload-artifact@v4

.github/workflows/snap-publish.yml

@@ -61,7 +61,12 @@ jobs:
           # electron-builder's snap target invokes snapcraft under the hood; in
           # CI we want destructive-mode (no LXD container).
           SNAPCRAFT_BUILD_ENVIRONMENT: 'host'
-        run: pnpm exec electron-builder --linux snap --config build/electron-builder.yml
+        # --publish never: electron-builder otherwise tries to push to the
+        # Snap Store during build when it sees a git tag, but
+        # SNAPCRAFT_STORE_CREDENTIALS is only available in the publish-*
+        # jobs below. Disable implicit publish; the dedicated job uses
+        # snapcore/action-publish with the credentials properly scoped.
+        run: pnpm exec electron-builder --linux snap --config build/electron-builder.yml --publish never
 
       - name: Locate snap file
         id: find