Publish merged releases from default branch pushes.

[samuel-williams-shopify]

GitHub's upcoming default policy would block publishing through pull_request_target. Trigger release-publish.yaml on pushes to the configured default branch, pin inspection to the pushed SHA, and require exactly one merged PR whose repository, base branch, and merge commit match before publishing.

Only validated releases enter the publishing job's concurrency group, with queue: max to retain pending releases while later changes land. Environment approval, signing, attestations, and artifact recovery remain in place. The workflow no longer needs allow-unsafe-pr-checkout or a pull_request_target policy exception.

Updates the generated workflow, release notes, guides, and distributed agent context. Existing PR-number resolve calls remain compatible during migration. Consumers adopt the trigger with gem:github:setup:update; their RubyGems Trusted Publisher configuration stays the same. Each release must be the tip of its own push, as with a normal GitHub PR merge.

Validation:

• 149 Sus tests passed (551 assertions); 523/523 library lines covered.
• RuboCop: 43 files, no offenses. Decode: 32/32 public definitions documented.
• New tests cover merge and squash releases, merged forks, later main commits, paginated associations, missing/ambiguous PRs, mismatched merge data, GitHub errors, and workflow output wiring.
• Read-only resolution of the real v0.3.0 commit returned PR Release v0.3.0 #27 and regenerated its release content without a diff.
• Workflow regeneration is idempotent; git diff --check passes.

GitHub references: push events, commit-to-PR lookup, queued concurrency.