ci: re-enable GitHub releases with @jscutlery/semver

[dianjuar]

PR Checklist

Please check if your PR fulfills the following requirements:

• Tests for the changes have been added (for bug fixes/features)
• Docs have been added/updated (for bug fixes/features)

What is the current behavior?

Release publishes to npm via publishment.yml and @jscutlery/semver:version, but does not create GitHub releases. The github post-target was removed in #603 after failures with protected main when semver tried to push with GITHUB_TOKEN.

Issue Number: #244

What is the new behavior?

• Run @jscutlery/semver:github after build and deploy via postTargets: ["build", "deploy", "github"] (no semver push; GIT_BOT_TOKEN still pushes to protected main).
• Grant contents: write on the release job and pass GITHUB_TOKEN for gh release create.
• Remove unused versionTagPrefix (semver uses tagPrefix; default {projectName}- matches existing tags).
• Document the flow in README.md and docs/README_contributors.md.

Does this PR introduce a breaking change?

• Yes
• No

Other information

• Protected main is unchanged: version commits/tags stay local until github-push-action with GIT_BOT_TOKEN.
• First production release after merge should be watched for gh release create and bot push success.

[github-actions]

Release preview

Simulates squash merge into main using the PR title as the commit message.
Only changes under packages/ngx-deploy-npm affect the version.

PR title: ci: re-enable GitHub releases with @jscutlery/semver

Semantic commit (PR title)

✅ Valid conventional commit

Version

9.1.0 → 9.2.0

Changelog preview

## [9.2.0](https://github.com/bikecoders/ngx-deploy-npm/compare/ngx-deploy-npm-9.1.0...ngx-deploy-npm-9.2.0) (2026-05-31)


### Features

* **ngx-deploy-npm:** extend checkExisting with skip mode and checkTag ([#749](https://github.com/bikecoders/ngx-deploy-npm/issues/749)) ([1250a91](https://github.com/bikecoders/ngx-deploy-npm/commit/1250a9189f46e62e56b03cde76522663c9918467))
* **ngx-deploy-npm:** forward npm publish passthrough flags ([#751](https://github.com/bikecoders/ngx-deploy-npm/issues/751)) ([371751b](https://github.com/bikecoders/ngx-deploy-npm/commit/371751b0f41fac6acb6597d6860ae4a88f86aecc))
* **ngx-deploy-npm:** log post-publish summary with streaming tarball size ([#750](https://github.com/bikecoders/ngx-deploy-npm/issues/750)) ([dbfe288](https://github.com/bikecoders/ngx-deploy-npm/commit/dbfe288a69f52f3749a6d80d4c54ddc87ea8afb0)), closes [#749](https://github.com/bikecoders/ngx-deploy-npm/issues/749)


### Bug Fixes

* **ngx-deploy-npm:** apply packageVersion transiently during dry-run ([#752](https://github.com/bikecoders/ngx-deploy-npm/issues/752)) ([cf7013f](https://github.com/bikecoders/ngx-deploy-npm/commit/cf7013f6311c1cbe3ab81dfe08b366ac323265df))
* **ngx-deploy-npm:** resolve open SonarCloud static analysis issues ([#746](https://github.com/bikecoders/ngx-deploy-npm/issues/746)) ([599ac29](https://github.com/bikecoders/ngx-deploy-npm/commit/599ac2971841cdec6fd720428ed2ae5546492ed5))

---

Generated by CI (PR Release Preview). Actual release runs on merge via publishment.yml.

Notes: Preview uses only the PR title (squash merge). Changes outside packages/ngx-deploy-npm do not trigger a version bump. Breaking changes must appear in the title (e.g. feat!:), not only in the PR description.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud