ci: split release-please into independent release and PR creation steps

[keelerm84]

Summary

Splits the single release-please-action call into two independent passes to support GitHub's immutable releases:

1. First pass (skip-github-pull-request: true): Creates the GitHub release only. If a release is created, the workflow checks out the repo and pushes the tag manually (with idempotent "already exists" guard).
2. Second pass (skip-github-release: true): Runs only when no release was created, and handles PR creation/updates.

This ensures the tag exists before release-please evaluates whether a release PR is still needed. Without this split, release-please could create a duplicate release PR because the tag wasn't present when it checked.

Matches the pattern established in ld-relay PR #622.

Review & Testing Checklist for Human

• Verify the release_created (singular) vs releases_created (plural) usage is correct — the inline tag-creation conditions use singular, while the job-level output consumed by downstream ci and publish jobs uses plural. Both are valid release-please outputs but confirm they behave as expected for this repo.
• Confirm the second release-please call's condition (release_created != 'true') correctly makes the two passes mutually exclusive — releases OR PRs, never both in the same run.
• Validate that the tag creation step's git config + git tag + git push flow works correctly under the actions/checkout@v4 default settings (shallow clone, detached HEAD, etc.).

Notes

• The pinned SHA 16a9c90856f42705d54a6fda1823352bdc62cf38 is unchanged; only the version comment was updated from # v4 to # v4.4.0 for clarity.
• No changes to downstream jobs (ci, publish) — they continue to gate on releases_created from the job outputs.

Link to Devin session: https://app.devin.ai/sessions/7d5bda4d9dbe4ae0b950b30a50485e60
Requested by: @keelerm84

---

Note

Medium Risk
Moderate risk because it changes the release workflow’s control flow and gating conditions for downstream ci/publish, which could affect whether releases are tagged/published correctly.

Overview
Splits the release-please workflow into two mutually exclusive release-please-action runs: one that only creates GitHub releases (skip-github-pull-request) and another that only opens/updates release PRs (skip-github-release) when no release was created.

When a release is created, the workflow now checks out the repo and creates/pushes the release tag manually with an idempotent “tag already exists” guard, and downstream ci/publish jobs are gated on the singular release_created output.

^{Reviewed by Cursor Bugbot for commit c1b16ef. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

Closing: The split release-please pattern is only needed for repos with artifact uploads. This attestation-only repo doesn't need it. The attestation changes are in PR #116.