fix(ci): split release-please PR and release workflows

Separate PR creation from tag/release creation to avoid race conditions that generated untagged drafts and oversized follow-up release PRs.

Made-with: Cursor

Author: beautyfree

.github/workflows/release-please-release.yml

@@ -0,0 +1,36 @@
+name: Release Please Tag and Release
+
+# Handles only release finalization for merged release PRs:
+# - creates/pushes vX.Y.Z tag
+# - creates draft GitHub release
+# Build/upload/publish is still done by release.yml (tag-triggered workflow).
+
+on:
+  push:
+    branches:
+      - main
+    # Release-PR merges modify only these metadata files.
+    paths:
+      - "CHANGELOG.md"
+      - "package.json"
+      - ".release-please-manifest.json"
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: release-please-release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release-please-release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: googleapis/release-please-action@v4
+        with:
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+          skip-github-pull-request: true
+          # Use PAT so pushed tags can trigger downstream tag workflows.
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}

.github/workflows/release-please.yml

@@ -1,15 +1,20 @@
-name: Release Please
+name: Release Please PR
 
 # Opens / updates a "Release PR" whenever conventional-commits land on main.
-# On merge, release-please bumps `package.json`, updates `CHANGELOG.md`, creates
-# a GitHub Release and pushes a matching `v<version>` tag. The tag push then
-# triggers `.github/workflows/release.yml` which builds & uploads the desktop
-# installers. Release notes come from the conventional commit messages.
+# This workflow only manages the PR itself. The actual tag + draft release
+# creation is handled by `release-please-release.yml` on release-PR merge
+# commits, which avoids release/PR race conditions.
 
 on:
   push:
     branches:
       - main
+    # Ignore release-PR merge commits (these only touch release metadata files).
+    # They are handled by release-please-release.yml.
+    paths-ignore:
+      - "CHANGELOG.md"
+      - "package.json"
+      - ".release-please-manifest.json"
 
 permissions:
   contents: write
@@ -27,6 +32,7 @@ jobs:
         with:
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
+          skip-github-release: true
           # IMPORTANT: tags created by GITHUB_TOKEN do NOT trigger other
           # workflows (GitHub deliberately breaks action→action chains). We
           # need release.yml to fire on the v* tag push so bins get built,