Land the release commit on main via an auto-merged PR

[TheGreatAxios]

Fixes the publish path in scripts/release.sh. Hit while cutting 0.2.105.

Problem

Step 4 pushed the release commit directly to main. The branch ruleset rejects that:

remote: error: GH013: Repository rule violations found for refs/heads/main
remote: - 4 of 4 required status checks are expected

So the script cross-compiled all four targets, then died at publish — leaving a version bump, a commit, and a vX.Y.Z tag that existed only locally, with nothing on GitHub. v0.2.104 shipped as PR #548 from a release-0.2.104 branch, so the PR route was already the de facto process; the script just didn't know it.

Change

• Release commit goes to a release-X.Y.Z branch and a PR that GitHub auto-merges once the same required checks pass. Reuses an already-open PR on a re-run.
• Tag is cut after the merge, not before. A squash or rebase merge rewrites the commit SHA, and a tag cut earlier would point at a commit that isn't in main. The PR is merged with --merge for the same reason, and the script asserts main is actually at the new version before tagging.
• Every stage stays idempotent: release commit already on main, PR already open, PR already merged, tag already on origin — each short-circuits.
• Header contract updated to match, including a warning that piping the script (release.sh X.Y.Z | tail -40) reports the pipe's exit code and makes a failed release read as success.

Also fixed

--no-push did not gate the GitHub release step, so a "dry run" still created or clobbered the live release. That's why this couldn't be dry-run tested before. Now gated.

Verification

• bash -n clean; shellcheck -S warning reports only the two pre-existing SC2115 warnings in the build block.
• ./scripts/release.sh 0.2.105 --no-push --skip-tap exits 0, skips every stage correctly, and leaves no side effects.
• The PR/auto-merge path itself is not exercised by a dry run — it only runs with pushes enabled against a version not yet on main. First real test is 0.2.106.

Refs CL-6957.

[linear-code]

CL-6957

[TheGreatAxios]

Verified against the live repo: this flow cannot arm auto-merge today.

gh pr merge --auto fails repo-wide right now:

GraphQL: Auto merge is not allowed for this repository (enablePullRequestAutoMerge)

Reproduced just now on two unrelated PRs (#563, #564), so it is a repository setting, not a per-PR state. As written, release.sh will reach line ~119 and die "could not arm auto-merge on PR #N" — a release attempt fails at the same step CL-6957 is about, just with a different message.

Two ways out: enable "Allow auto-merge" in repository settings (Settings -> General -> Pull Requests) and this works as designed, or fall back to polling the required checks and issuing a plain gh pr merge --merge once they pass, which needs no repo setting change. Worth deciding before this merges, since the script's whole publish path depends on it.