ci: release.yml byte-identical to the proven api workflow

[ronaldtse]

Summary

• the previous release.yml, though YAML-valid and registered, fails every tag run with 0 jobs ("workflow file issue"); cause not diagnosable via API
• this PR makes release.yml byte-identical to interscript/api's workflow, which has published 1.0.1 and 1.0.2 on tag pushes — eliminating every difference

Test plan

• after merge: re-tag v0.1.0, Release run executes jobs and publishes (or fails at the npm trusted-publisher step, which is the expected next blocker for a brand-new package name)