Add release automation + tighten enforce-main-source against forks

.github/workflows/enforce-main-source.yml

@@ -15,10 +15,18 @@ jobs:
   check-source-branch:
     runs-on: ubuntu-latest
     steps:
-      - name: Verify source is staging
+      - name: Verify source is staging from this repo
         run: |
+          # Reject fork PRs. Forks can only PR through staging in their own
+          # fork, and that source repo isn't this one — block them. Combined
+          # with the repo's collaborator list controlling who can push to
+          # this repo's staging, this gates main to repo-write-access only.
+          if [ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]; then
+            echo "::error::PRs to main must originate from a branch in this repo, not a fork. Source repo: ${{ github.event.pull_request.head.repo.full_name }}"
+            exit 1
+          fi
           if [ "${{ github.head_ref }}" != "staging" ]; then
             echo "::error::PRs to main must come from the 'staging' branch only. Got: '${{ github.head_ref }}'"
             exit 1
           fi
-          echo "PR source is 'staging' — OK"
+          echo "PR source is 'staging' from this repo — OK"

.github/workflows/release.yml

@@ -0,0 +1,47 @@
+name: Create release on tag push
+
+# When a version tag (vX.Y.Z) is pushed, create a corresponding GitHub
+# Release. Version 0.x.x tags are marked as pre-releases; 1.x.x+ tags
+# are full releases. Release notes auto-generated from commit history
+# since the previous tag.
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Determine release type
+        id: type
+        run: |
+          TAG="${GITHUB_REF#refs/tags/}"
+          VERSION="${TAG#v}"
+          MAJOR="${VERSION%%.*}"
+          if [ "$MAJOR" = "0" ]; then
+            echo "prerelease=true" >> "$GITHUB_OUTPUT"
+            echo "Tag $TAG is 0.x.x — marking as pre-release"
+          else
+            echo "prerelease=false" >> "$GITHUB_OUTPUT"
+            echo "Tag $TAG is $MAJOR.x.x — marking as full release"
+          fi
+
+      - name: Create release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          TAG="${GITHUB_REF#refs/tags/}"
+          if [ "${{ steps.type.outputs.prerelease }}" = "true" ]; then
+            gh release create "$TAG" --generate-notes --prerelease --title "$TAG"
+          else
+            gh release create "$TAG" --generate-notes --title "$TAG"
+          fi