ci(release): gate release pipeline to version-shaped tags only

The `release: published` event fires for ANY GitHub release, including
non-package releases that merely host assets — e.g. the `embed-v1`
embedder-weights release this PR introduces (model-pins.ts pins its
URLs). Creating that release triggered the full build → sign →
npm-publish pipeline, which would have published every package to npm
(OCH_NPM_PUBLISH_ENABLED is true). It was cancelled in time and built
from main (not this branch), so nothing leaked, but the trigger must be
filtered.

Gate the `resolve` job (root of the chain; everything else `needs` it
under a success() gate) to version-shaped tags only: `root-v*`, `cli-v*`,
or bare `v*` (the release-please conventions). `workflow_call` /
`workflow_dispatch` pass an explicit tag input and remain unaffected. A
weights tag like `embed-v1` now skips the pipeline entirely.

Author: theagenticguy

.github/workflows/release.yml

@@ -67,6 +67,18 @@ jobs:
   resolve:
     name: Resolve release tag + SHA
     runs-on: ubuntu-latest
+    # Only run the package-release pipeline for version-shaped tags. The
+    # `release: published` event also fires for non-package releases that
+    # merely HOST assets — e.g. the `embed-v1` embedder-weights release
+    # (see packages/embedder/src/model-pins.ts) — which must NOT build,
+    # sign, or npm-publish anything. release-please tags are `root-v*`,
+    # `cli-v*`, or a bare `v*`; `workflow_call`/`workflow_dispatch` pass an
+    # explicit tag input and are always allowed.
+    if: >-
+      github.event_name != 'release'
+      || startsWith(github.event.release.tag_name, 'root-v')
+      || startsWith(github.event.release.tag_name, 'cli-v')
+      || startsWith(github.event.release.tag_name, 'v')
     outputs:
       tag: ${{ steps.t.outputs.tag }}
       sha: ${{ steps.t.outputs.sha }}