Automate safe releases without labels

[tidy-dev]

Summary

• run a daily, label-free release classifier with manual dispatch support
• automatically publish dependency-only bundled runtime updates as patch releases
• create or update one draft minor release for potentially behavioral shipped changes
• fail closed when src/** changes without a rebuilt dist/** bundle
• reuse the existing release workflow for both publishing and draft updates
• publish matching drafts manually and move the mutable major tag only to the highest published stable release
• restrict version discovery to strict stable semver tags and reject stale release baselines

Design

The implementation is limited to four changed files: one tested classifier, the automatic caller, the reusable/manual release workflow, and focused classifier tests. Release execution is serialized with shared concurrency and rechecks the classified base tag after entering the release workflow.

Safety and idempotency

• accompanying tests, docs, and .github/** changes do not trigger releases by themselves
• unknown files accompanying shipped changes are treated as behavioral
• repeated runs update the matching draft instead of creating duplicates
• conflicting or stale drafts are reported instead of replaced
• automatic patch releases refuse to publish an existing draft
• retries tolerate an already-published release and reconcile its mutable major tag
• GITHUB_TOKEN permissions are scoped per job, and scheduled invocation does not depend on recursive workflow events

Validation

• npm test -- --runInBand
• npm run build -- --pretty false
• parsed all workflow YAML with js-yaml
• reviewed the final diff for GitHub Actions semantics, idempotency, version safety, and shell/API injection