ci: release only from main

[devkade]

Summary

• Change release workflow from tag-push trigger to main-branch push trigger
• Create the release tag inside the main-only workflow
• Skip publish if the version tag already exists, avoiding duplicate npm publishes

Why

Previously any pushed v* tag triggered Release & Publish, regardless of whether the tagged commit came from dev. This allowed a dev tag to publish to npm before human-reviewed dev → main merge.

Checks

• Workflow-only change; CI will validate on PR.