commit release versions after release

Author: tarik02

.github/workflows/release.yml

@@ -883,7 +883,7 @@ jobs:
 
   finalize:
     name: Finalize release
-    if: false # Disabled for the fork: avoid committing release-only version bumps back to main.
+    if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.release.result == 'success' }}
     needs: [preflight, release]
     runs-on: ubuntu-latest
     timeout-minutes: 10

FORK.md

@@ -9,7 +9,7 @@ This repository is a fork of `pingdotgg/t3code`. Keep this file focused on fork
 - Fork workflows disable scheduled releases, relay jobs, hosted deploys, and fork-unsafe publish paths.
 - Release build jobs skip relay client tracing config because the relay config job is disabled.
 - Release builds publish updater metadata against the fork repository.
-- Fork release versions are derived in the release workflow so package manifests stay close to upstream.
+- Fork release versions are derived in the release workflow and committed back to main after release.
 - macOS release signing is separate from Apple notarization.
 - Self-signed macOS signing certificates are trusted during release builds.