release: guard pre-release (-pre) tags out of the stable channel

A hyphenated tag (v0.23.0-pre) should ship binary + content as a GitHub
pre-release without promoting to stable. Three minimal guards:

- release.yml: gate the "Stamp plugin manifests" step (which also advances
  refs/heads/stable) on `if: "!contains(github.ref, '-')"` so a -pre tag
  skips both manifest-stamp and stable-ref advance; a final vX.Y.Z still runs.
- .goreleaser.yaml: `skip_upload: auto` on both Homebrew casks so a -pre tag
  does not bump the casks (keys off the parsed semver pre-release indicator).
- .goreleaser.yaml: `release.prerelease: auto` so goreleaser actually marks
  the -pre tag a GitHub pre-release. goreleaser's default is `false`, so
  without this a -pre tag would publish as a full latest release.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: clkao

.github/workflows/release.yml

@@ -197,6 +197,11 @@ jobs:
       # key is a DIFFERENT file (marketplace.json) and is left untouched here; it is
       # the moving-branch re-pull key (AC-2d), pj's surface.
       - name: Stamp plugin manifests to the release version
+        # A hyphenated tag is a pre-release (v0.23.0-pre); it ships binary +
+        # content as a GitHub pre-release but must stay OUT of the stable channel,
+        # so skip both the manifest stamp and the stable-ref advance below. A final
+        # vX.Y.Z has no hyphen and still runs, advancing stable as before.
+        if: "!contains(github.ref, '-')"
         run: |
           set -euo pipefail
           RELEASE_VERSION="${GITHUB_REF_NAME#v}"

.goreleaser.yaml

@@ -89,6 +89,12 @@ checksum:
   algorithm: sha256
 
 release:
+  # `auto` marks the GitHub release as a pre-release (not "latest") when the tag
+  # carries a semver pre-release indicator, e.g. v0.23.0-pre. goreleaser's own
+  # default is `false`, so without this a -pre tag would publish as a full latest
+  # release. This is the signal `homebrew_casks.skip_upload: auto` reads to skip
+  # the cask bump for a pre-release; a final vX.Y.Z stays a normal release.
+  prerelease: auto
   github:
     owner: spacedock-dev
     name: spacedock
@@ -104,6 +110,11 @@ homebrew_casks:
   # archive, installs the `next` plugin). Each pins ONLY its own channel's archive
   # via `ids: [<archive-id>]` so the two casks never cross-pin.
   - name: spacedock
+    # `auto` skips the cask bump when goreleaser marks the release a pre-release
+    # (release.prerelease: auto flags a hyphenated tag like v0.23.0-pre), so a
+    # `-pre` cut never advances the stable `spacedock` cask. A final vX.Y.Z is not
+    # a pre-release, so the cask still publishes.
+    skip_upload: auto
     ids:
       - spacedock-stable
     repository:
@@ -140,6 +151,9 @@ homebrew_casks:
   # devBranch=next binary that installs the `next` plugin. Its on-demand re-pull
   # cadence rides the unchanged next-publish.yml; goreleaser only emits the cask.
   - name: spacedock@next
+    # Same pre-release guard as the stable cask: a hyphenated (pre-release) tag
+    # skips the edge cask bump, while a final vX.Y.Z still publishes it.
+    skip_upload: auto
     ids:
       - spacedock-edge
     repository: