ci: install labkit-generated release workflow

Cuts a tagged GitHub Release (v0.1.0 first) on push to main / dispatch.
Source: operatorstack/intelligence-flow labs/21-interlock (labkit gen).

Author: bigboateng

.github/workflows/release.yml

@@ -0,0 +1,94 @@
+# Generated by labkit (python -m labkit gen). Do not edit by hand.
+# Edit labs/<lab>/publish.config.json and regenerate; drift fails `labkit doctor`.
+# Install into operatorstack/interlock at .github/workflows/release.yml (bootstrap step).
+name: Release Interlock
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: Version bump for a manual release
+        type: choice
+        options: [patch, minor, major]
+        default: patch
+
+permissions:
+  contents: write
+  pull-requests: read
+
+concurrency:
+  group: release-interlock
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Resolve release policy
+        id: policy
+        env:
+          GH_TOKEN: ${{ github.token }}
+          MANUAL_BUMP: ${{ inputs.bump }}
+        shell: bash
+        run: |
+          bump="${MANUAL_BUMP:-patch}"
+          skip="false"
+          if [[ "${GITHUB_EVENT_NAME}" == "push" ]]; then
+            labels="$(gh api \
+              -H 'Accept: application/vnd.github+json' \
+              "/repos/${GITHUB_REPOSITORY}/commits/${GITHUB_SHA}/pulls" \
+              --jq '.[0].labels[].name' 2>/dev/null || true)"
+            if grep -qx 'skip-release' <<<"$labels"; then skip="true"; fi
+            if grep -qx 'major' <<<"$labels"; then
+              bump="major"
+            elif grep -qx 'minor' <<<"$labels"; then
+              bump="minor"
+            fi
+          fi
+          echo "bump=$bump" >> "$GITHUB_OUTPUT"
+          echo "skip=$skip" >> "$GITHUB_OUTPUT"
+      - name: Compute version
+        if: steps.policy.outputs.skip != 'true'
+        id: version
+        env:
+          BUMP: ${{ steps.policy.outputs.bump }}
+        shell: bash
+        run: |
+          latest="$(git tag --list 'v[0-9]*' --sort=-v:refname | head -n 1)"
+          if [[ -z "$latest" ]]; then
+            next="v0.1.0"
+          else
+            raw="${latest#v}"
+            IFS=. read -r major minor patch <<<"$raw"
+            case "$BUMP" in
+              major) major=$((major + 1)); minor=0; patch=0 ;;
+              minor) minor=$((minor + 1)); patch=0 ;;
+              patch) patch=$((patch + 1)) ;;
+              *) echo "Invalid bump: $BUMP" >&2; exit 2 ;;
+            esac
+            next="v${major}.${minor}.${patch}"
+          fi
+          echo "version=$next" >> "$GITHUB_OUTPUT"
+      - name: Publish release
+        if: steps.policy.outputs.skip != 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.version.outputs.version }}
+        shell: bash
+        run: |
+          if git rev-parse --verify --quiet "refs/tags/$VERSION"; then
+            echo "Tag $VERSION already exists; nothing to release."
+            exit 0
+          fi
+          git tag "$VERSION" "$GITHUB_SHA"
+          git push origin "$VERSION"
+          gh release create "$VERSION" \
+            --repo "$GITHUB_REPOSITORY" \
+            --title "$VERSION" \
+            --generate-notes \
+            --verify-tag