CI: cut redundant builds and make tag releases atomic

[valentinozegna]

Summary

• run one required CI workflow per pull request and cancel superseded runs
• make version tags call that same CI before packaging or publishing
• publish the exact CI-built npm tarball, then build/sign binaries in one release job
• generate release notes from merged PRs instead of a separate changelog/version PR
• use a development-only package version on main; the tag stamps every shipped artifact

The repository ruleset was also simplified from merge queue + required check to a strict up-to-date required check. Main remains PR-only and protected, but each merge no longer triggers a synthetic queue build.

Actions impact

Typical feature: PR CI only (previously PR + merge queue + main push).

Release: tag-driven CI + packaging/release (previously release PR + merge queue + main push + tag release + separate npm build).

Testing

• npm run type-check
• npm run lint
• npm test (993 passed, 5 skipped)
• npm run build
• shellcheck scripts/tag-release.sh scripts/build-binary.sh
• YAML parse check for both workflows
• dry-run version stamping and npm tarball inspection