ci: trigger release on version tag push (v*)

[arv]

What

Make the release pipeline run when a v* tag is pushed, so the manual flow npm version <type> + git push --tags cuts a release (npm publish with provenance + prebuilt binaries).

Changes

• on: — add push.tags: ['v*']; remove the release trigger.
• publish + all prebuild* jobs — gate on startsWith(github.ref, 'refs/tags/v') instead of github.event_name == 'release'.
• prebuild* jobs — add permissions: contents: write. prebuild -u creates the GitHub release and uploads the .node assets (see prebuild/upload.js), which needs write access; this repo's default workflow token is read-only.
• publish keeps id-token: write for OIDC provenance.

Release flow after this merges

Important

A tag only triggers the workflow version present at the tagged commit, so this must be on main before a tag push will do anything.

Then, to cut a release:

git checkout main && git pull
npm version minor        # bumps package.json, commits, tags vX.Y.Z
git push origin vX.Y.Z   # tag push triggers test → prebuild → publish

main is protected (PRs only), so the bump commit can't be pushed to main directly — only the tag. The publish job checks out the tag, so the published version is correct; main's package.json can be synced with a follow-up PR (or do the bump via PR first, then tag the merged commit).

🤖 Generated with Claude Code

[arv]

Closing — going with the existing release event trigger instead of tag-push (manual npm version + manually publishing a GitHub Release gates the build, which is the desired behavior). The one still-useful piece from this PR is the contents: write permission on the prebuild jobs (needed for prebuild -u to upload .node assets to the release); happy to bring that back as a focused PR if wanted.