fix(workflows): switch recompile-safe-output-fixtures trigger to release:published and drop broken Step 0

[jamesadevine]

Summary

Fixes the bail-out bug seen in run 27021589908. After PR #868 landed, the release workflow finished for the merge commit and workflow_run fired the recompile workflow. The agent ran Step 0's bash and got back empty strings for both release_conclusion and head_branch, so it bailed out with noop — even though head_branch on the run itself was clearly main.

Root cause: Step 0 read github.event.workflow_run.{conclusion,head_branch} from $GITHUB_EVENT_PATH inside the AWF chroot sandbox. The event file isn't reliably readable by the sandboxed awfuser (UID 1001), so jq … 2>/dev/null || echo "" silently returned empty for both fields and the if "$CONCLUSION" != "success" branch fired on every invocation. Confirmed in the agent's process log (tooluse_qYI5wexrspAEDMxqn0RkIZ) which shows the model interpreting both fields as empty.

This PR:

1. Switches the trigger from workflow_run: { workflows: [Release] } to release: { types: [published] }. The new trigger only fires when a release is actually published, instead of on every push to main (which previously caused a no-op recompile cycle every time anything landed). The brief window between release creation and binary asset upload is already handled by Step 2's bounded retry.

2. Removes Step 0 entirely. The two cases it was trying to guard against are already handled downstream:

   • "Release didn't publish anything new" — now impossible under the release: published trigger.
   • "Release published but assets missing" — Step 2's bounded retry hits report-incomplete after the retry window expires.

3. Drops the corresponding bullet from the "When NOT to open a PR" list and updates the prose note explaining the trigger.

Test plan

• Manually inspected tooluse_qYI5wexrspAEDMxqn0RkIZ in the agent process log to confirm both CONCLUSION and HEAD_BRANCH were empty even though head_branch on the run was main.
• Verified release: { types: [published] } is supported by gh-aw v0.77.5 (pkg/workflow/trigger_parser.go).
• Lock file regenerated with gh aw compile recompile-safe-output-fixtures.
• Will be exercised end-to-end on the next ado-aw release.

Follows from #868 (per-file compile loop + integrity heuristic, also already merged).