ci(gha): push-only release gating, npm auth hardening, strict tag push; pin pnpm via packageManager and fix Prettier config resolution

Author: CharlieHelps

.github/workflows/release.yml

@@ -3,9 +3,9 @@ name: CI — test → gate → release
 on:
   push:
     branches:
-      - '**'
+      - "**"
     tags:
-      - '**'
+      - "**"
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
 
@@ -87,7 +87,7 @@ jobs:
   release:
     name: Release
     needs: [test, determine_release]
-    if: needs.determine_release.outputs.is_release == 'true' || needs.determine_release.outputs.is_prerelease == 'true'
+    if: ${{ github.event_name == 'push' && (needs.determine_release.outputs.is_release == 'true' || needs.determine_release.outputs.is_prerelease == 'true') }}
     permissions:
       contents: write
     runs-on: ubuntu-latest
@@ -112,6 +112,7 @@ jobs:
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml
           registry-url: https://registry.npmjs.org
+          always-auth: true
         env:
           # Ensure the registry is authenticated for publish
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
@@ -127,4 +128,4 @@ jobs:
           pnpm changeset status
           pnpm changeset version
           pnpm changeset publish
-          git push --follow-tags --no-verify || true
+          git push --follow-tags --no-verify

packages/eslint-config/package.json

@@ -19,6 +19,9 @@
 		"eslint-plugin-sonarjs": "^3.0.2",
 		"eslint-plugin-unused-imports": "^4.0.0"
 	},
+	"devDependencies": {
+		"@mikecbrant/prettier-config": "workspace:*"
+	},
 	"publishConfig": {
 		"access": "public"
 	},