fix(ci): dispatch publish.yml on the release tag, fail if no Publish run starts

[EtaCassiopeia]

Fixes #253

Problem

auto-release.yml pushed the v0.3.3 tag with RELEASE_TOKEN, but no Publish run ever started, so the release sat unpublished until publish.yml was dispatched on the tag by hand. Whether a pushed tag triggers on: push: tags depends on what kind of credential the secret holds, and the workflow can't see that.

Change

• auto-release.yml: after pushing the tag, a new step waits 45 s for a push-triggered Publish run for the tag. If none appears, it runs gh workflow run publish.yml --ref "$TAG". A workflow_dispatch made with GITHUB_TOKEN always triggers, and the job now has actions: write. The step then waits up to 5 min for a Publish run whose head branch is the tag. If none appears, the job fails with ::error:: and prints the manual command.
• publish.yml (double-publish guard, in case both the tag push and the dispatch start a run):
  • concurrency: publish-${{ github.ref }}, cancel-in-progress: false: runs for the same tag are serialized and never cancelled mid-deploy.
  • On a refs/tags/v* ref, the credentials guard sets deploy=false (clean no-op) when a GitHub Release for the tag already exists, or when the Central Portal's /api/v1/publisher/published returns "published": true for rift-java-core. Any other answer goes on to deploy, where a real duplicate still fails loudly. bump-snapshot is already idempotent.
• CONTRIBUTING's release section now describes both triggers.

Validation

I couldn't run the full chain without cutting a release. Here is what I checked instead:

• actionlint: auto-release.yml is clean. The remaining findings are the same 4 shellcheck infos that are on master (dep-bump.yml, publish.yml's $flags, relocation-publish.yml).
• Tag-ref dispatch semantics: in manual run 36541397283 (--ref v0.3.3), every tag-gated step ran (Releasing 0.3.3 from tag v0.3.3, Release created, snapshot bumped). So github.ref/GITHUB_REF_NAME are refs/tags/v0.3.3/v0.3.3 on a dispatch.
• Run detection: gh run list --workflow publish.yml --branch v0.3.3 returns that workflow_dispatch run, and --branch v0.3.2 returns the push run. So the filter matches both trigger kinds.
• Guard script, extracted and run locally against the real repo/Portal:
  • v0.3.3 gives deploy=false (Release exists).
  • v9.9.9 gives deploy=true. The Portal endpoint answered Invalid token to fake credentials, which confirms the endpoint exists and that a non-true answer proceeds.
  • master gives deploy=true.

🤖 Generated with Claude Code