refactor(ci): collapse to single release workflow, skip pr.yml on release-please PRs (#18)

refactor(ci): collapse to single release workflow, skip pr.yml on
release-please PRs

- Delete `ci.yml` and fold its responsibilities into a single
manifest-mode `release.yml` (release-please opens the release PR and
cuts the release in one coherent run; `build-release-binary` gated on
`release_created`; no main build-test job — pr.yml gates merges).
- `pr.yml` uses `paths-ignore` on the version/changelog files so it does
not trigger on release-please's bot PRs, avoiding the GITHUB_TOKEN
approval-required prompt.

Author: ModifAmorphic

.github/workflows/ci.yml

@@ -1,16 +1,26 @@
 name: PR Quality Gate
 
+# Skip release-please's bot-authored release PRs entirely: they only touch
+# version/changelog files, so paths-ignore prevents the workflow from
+# triggering at all — which avoids the approval-required run that
+# GITHUB_TOKEN-created PRs otherwise sit in.
 on:
   pull_request:
     branches: [main, release-please-refactor]
+    paths-ignore:
+      - 'CHANGELOG.md'
+      - '.release-please-manifest.json'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'crates/**/Cargo.toml'
+      - 'crates/**/CHANGELOG.md'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   lint:
-    if: ${{ !startsWith(github.head_ref, 'release-please--branches--') }}
     runs-on: ubuntu-latest
 
     steps:
@@ -29,7 +39,6 @@ jobs:
         run: cargo clippy --workspace --all-targets -- -D warnings
 
   test:
-    if: ${{ !startsWith(github.head_ref, 'release-please--branches--') }}
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:

.github/workflows/pr.yml

@@ -1,12 +1,12 @@
 name: Release
 
-# Cut a release only when release-please's manifest changes — i.e. a
-# release-please release PR was merged. The manifest is touched only by
-# release-please, only when a release is cut.
+# release-please in manifest mode: on each push it opens/maintains the release
+# PR; when that PR is merged, it cuts the tag + GitHub Release and the binary
+# build runs. There is intentionally no build/test job here -- pr.yml already
+# gates every merge, so main is trusted.
 on:
   push:
     branches: [main, release-please-refactor]
-    paths: ['.release-please-manifest.json']
 
 permissions:
   contents: write
@@ -28,7 +28,6 @@ jobs:
         with:
           config-file: .release-please-config.json
           target-branch: release-please-refactor
-          skip-github-pull-request: true
 
   build-release-binary:
     needs: release-please