Switch publish trigger from push→main to workflow_run + workflow_dispatch

[Copilot]

The publish workflow lost its workflow_run trigger, leaving only workflow_dispatch. This broke the pattern used across other repos (e.g. complog) where automatic patch releases fire after CI passes, and manual dispatch is reserved for major/minor bumps.

Changes

• Triggers: replace push: branches: [main] with workflow_run on "Code Validation" (completed, main branch) — publishes automatically only after CI succeeds
• workflow_dispatch: version input is now required: true — manual runs always specify an explicit version (major/minor bumps)
• Job guard: added if condition so the job only runs on workflow_dispatch or a successful workflow_run, not on CI failures
• Version logic: workflow_dispatch → use provided version directly; workflow_run → auto-increment patch from latest v* tag

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Package Version'
        required: true
  workflow_run:
    workflows: ["Code Validation"]
    branches: [main]
    types: [completed]

jobs:
  publish:
    if: >-
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')