ci: auto-release on package.json version bump

[askalf]

Summary

Adds auto-release.yml: watches package.json on main, and when a merge bumps the version, cuts the matching v<X.Y.Z> GitHub release, builds, and publishes to npm — inline, in a single workflow run.

Eliminates the manual gh release create step that today's v3.3.0 ship required. Future flow:

1. PR bumps package.json version + adds CHANGELOG.md entry
2. PR merges
3. auto-release.yml fires on pull_request: closed, sees the version diff, cuts the release, ships to npm
4. ~90 seconds end-to-end, no human-in-the-loop

Why inline publish (not delegated to publish.yml)

gh release create from CI authenticates as GITHUB_TOKEN. GitHub suppresses downstream workflow runs from GITHUB_TOKEN-attributed events — the same anti-loop rule that stranded askalf/dario's cc-drift PRs earlier today (fixed in askalf/dario#361). If this workflow created a release and relied on publish.yml's release: published trigger, that event wouldn't fire and the package would silently never reach npm.

The existing publish.yml stays in place for the manual-maintainer path: a gh release create run locally as a real user DOES fire release: published.

Triggers

Trigger	When	Why
pull_request: closed on main	Within seconds of merge	Fast path. merged == true guard rules out close-without-merge.
schedule hourly :15	Backup hourly	Catches bot-merged PRs, force-pushes, hand-pushed version bumps. Safe to over-fire thanks to the idempotency gate.
workflow_dispatch	Manual	Rescue + replay.

Idempotency

Gate checks BOTH gh release view v<X.Y.Z> succeeds AND npm view @askalf/agent@<X.Y.Z> returns the version. Skips downstream steps only when both are true. A half-shipped state (tag exists, npm publish failed because NPM_TOKEN had been revoked) self-heals on the next trigger once the underlying issue resolves — same model that fixed dario v4.8.2 + v4.8.3 last week.

Pattern source

askalf/dario's cc-drift-auto-release.yml minus the cc-drift-bot-branch logic and the ghcr docker publish step (agent is a pure CLI, no docker image). Validated in dario production since 2026-04-23 across ~40 releases.

Test plan

• Merge
• gh workflow run auto-release.yml -R askalf/agent → idempotency gate sees v3.3.0 already fully shipped (GitHub release + npm), workflow short-circuits cleanly within ~10s with no side effects. This is the safest smoke test — proves the trigger + gate path works without an actual release.
• Next time a real version bump merges (eventually), confirm the release fires automatically and lands on npm without manual gh release create.