[LeeEirc]

Why

Starting a release currently requires a separate tag push or manual workflow dispatch after the code is reviewed. Allow a reviewed version change to request publication through the normal pull-request workflow.

Release intent

This PR adds VERSION with v0.1.0. Merging it into master will start the first v0.1.0 release, after the release checks pass. Opening or updating this PR only runs read-only checks and snapshot builds; it does not publish.

Changes

• Add a master push trigger restricted to changes in VERSION. Ordinary code/documentation pushes do not request a release. A direct push that changes VERSION also requests publication; the workflow does not claim to enforce PR-only merges.
• Resolve the version in a read-only prepare job and pass the validated tag to the test/publish chain. Version-file releases read the exact event commit; existing manual and tag-push entry points keep their own version inputs.
• Serialize publication by the resolved version across all three entry points. Preserve the tested commit, existing-tag commit checks, published-version protection, and Draft → assets → attestation → publish ordering.
• Create an annotated tag from master only after tests pass. No personal token or additional publishing permissions are introduced.
• Document the version-PR flow, the first-release effect, and retry behavior. VERSION records publishing intent; binary version metadata still comes from GoReleaser or embedded Go module/VCS information.
• Add regression checks for trigger/ref selection, SemVer/prerelease validation, single-line version files, output injection, and the actual checked-in VERSION. Run these checks in Linux CI.

Validation

• All 13 Python regression tests passed locally.
• Both workflow files parsed successfully; all shell blocks passed Bash syntax checks.
• Local documentation targets and git diff --check passed.
• Independent review found no blocking issues in trigger filtering, fixed-commit handling, permissions, tag protection, or publication concurrency.
• All five PR CI jobs passed for 7f9a720970f7dc45509803cea1e68d388abf248b: Linux/Windows × Go 1.20.x/stable plus the six-platform GoReleaser snapshot. The new release-target checks, race tests, vet, Linux PTY/TCP checks, archive checksums, and extracted Linux CLI smoke checks passed.
• GitHub automatically requested Copilot review, but Copilot reported insufficient account quota and did not produce a code review. Independent review completed with no blocking findings.
• Production publication will only be exercised after this PR is merged.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.