Taskfile: task release auto-creates the release branch (#177)

Previously the task refused to run on main and told the user to
`git checkout -b release/... && task release`. Friction for a step
with one obvious value (the date).

New behavior: from main, `task release -- patch` pulls latest main,
creates `release/<timestamp>`, bumps, commits, pushes, opens PR.
Refuses to run NOT on main (inverted), and refuses if local main
has unpushed commits (weird state worth surfacing).

RUNBOOK updated.

Author: LarsenCundric

RUNBOOK.md

@@ -4,12 +4,13 @@ Decision guide for the `/sdk` pipeline. Read this, then go.
 
 ## Releasing
 
-1. **From a fresh branch off main, run `task release -- patch`** (or `minor` / `major`). This bumps both `browser-use-node/package.json` and `browser-use-python/pyproject.toml` to the next version, commits as `release: v<NEW_VERSION>`, pushes the branch, and opens a PR.
+1. **From `main`, run `task release -- patch`** (or `minor` / `major`). This pulls latest main, creates a fresh `release/<timestamp>` branch off it, bumps both `browser-use-node/package.json` and `browser-use-python/pyproject.toml`, commits as `release: v<NEW_VERSION>`, pushes the branch, and opens a PR.
 
    Manual alternative (if you don't want the helper):
 
    ```bash
-   git checkout -b release/$(date +%Y%m%d) main
+   git checkout main && git pull --ff-only origin main
+   git checkout -b release/$(date +%Y%m%d-%H%M%S)
    task version:bump -- patch
 
    # Read the new version after the bump, then use it in commit + PR.

Taskfile.yml

@@ -199,23 +199,36 @@ tasks:
             exit 1
           fi
 
-          # Refuse to run on main directly — releases must go through a PR for
-          # the auto-detector to fire on merge.
+          # The task auto-creates the release branch from main, so it must be
+          # run FROM main. Refuse otherwise — running from a feature branch
+          # would surprise the user with a branch named off a non-main tip.
           CURRENT_BRANCH="$(git rev-parse --abbrev-ref HEAD)"
-          if [ "$CURRENT_BRANCH" = "main" ]; then
-            echo "ERROR: refusing to run on main. Releases go through a PR; the auto-detector fires on merge." >&2
-            echo "Run from a fresh branch off main, e.g.:" >&2
-            echo "  git checkout -b release/\$(date +%Y%m%d) main && task release -- $BUMP" >&2
+          if [ "$CURRENT_BRANCH" != "main" ]; then
+            echo "ERROR: refusing to run. \`task release\` auto-creates a release branch off main, so it must be started from main." >&2
+            echo "Currently on: $CURRENT_BRANCH" >&2
+            echo "Switch first:" >&2
+            echo "  git checkout main" >&2
             exit 1
           fi
 
-          # Make sure we're up-to-date with main so the bump diff is clean.
+          # Fast-forward main to origin/main so the new branch is based on the
+          # latest published main, not whatever stale state we have locally.
+          # --ff-only fails if local main has unpushed commits, which would be
+          # weird — bail loud so the user reconciles.
           git fetch origin main --quiet
           if ! git merge-base --is-ancestor origin/main HEAD; then
-            echo "ERROR: branch is behind origin/main. Rebase first:" >&2
-            echo "  git rebase origin/main" >&2
+            echo "ERROR: local main has commits not on origin/main. Reconcile before releasing." >&2
+            echo "  git log origin/main..HEAD --oneline" >&2
             exit 1
           fi
+          git pull --ff-only origin main --quiet
+
+          # Create the release branch. Date+time keeps it unique across
+          # multiple releases the same day; the branch auto-deletes on PR merge
+          # (squash + delete-on-merge), so the branch list stays clean.
+          NEW_BRANCH="release/$(date +%Y%m%d-%H%M%S)"
+          git checkout -b "$NEW_BRANCH"
+          echo "::notice::Created release branch $NEW_BRANCH from main."
       - task: "version:bump"
         vars: { CLI_ARGS: '{{.CLI_ARGS | default "patch"}}' }
       - cmd: |