feat: promote npm edge tag to latest when prerelease is promoted

[AaronFeledy]

Problem

When a release is published as a prerelease, it gets tagged as edge on npm. Later, when the release is promoted to a full release in GitHub, the npm latest tag doesn't update because the workflow only triggered on published.

Solution

• Added released to the release workflow trigger types
• New lightweight promote job that only runs npm dist-tag add latest — no install, no lint, no tests, no re-publish
• Only fires on the released event (when a prerelease is promoted to full release)
• Existing deploy job is now explicitly gated to published events only (no behavior change)
• Uses TAG_NAME env var instead of direct interpolation to prevent script injection

Flow

1. Publish as prerelease → full pipeline runs, publishes with edge tag (unchanged)
2. Promote release → uncheck prerelease → promote job runs, points latest to that version (~15s)

The dist-tag add command is idempotent, so if both published and released fire on a fresh non-prerelease publish, the redundant promote is harmless.

---

Note

Low Risk
CI-only change limited to npm dist-tag updates on a new release event; main risk is incorrect tagging if the tag/version parsing is wrong or credentials are misconfigured.

Overview
Extends the Publish to NPM GitHub Actions workflow to also trigger on release.released events.

Adds a new promote job that runs only on released to set the npm latest dist-tag to the promoted version (derived from the GitHub tag) without reinstalling deps, running tests, or republishing.

Explicitly gates the existing deploy publish job to release.published events to avoid running the full pipeline on promotion events.

^{Written by Cursor Bugbot for commit 3edee88. This will update automatically on new commits. Configure here.}

[netlify]

❌ Deploy Preview for lando-go failed. Why did it fail? →

Name	Link
🔨 Latest commit	3edee88
🔍 Latest deploy log	https://app.netlify.com/projects/lando-go/deploys/6997dc32b65b670008cdcaeb

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A Cloud Agent has been kicked off to fix the reported issue.}

[cursor]

Race condition: promote job fails on fresh non-prerelease

Medium Severity

When a non-prerelease is published directly, GitHub fires both published and released events, creating two independent workflow runs. The promote job (~15s) will almost certainly execute npm dist-tag add before the deploy job (~minutes of install/lint/test/publish) finishes npm publish. Since the version doesn't exist on npm yet, dist-tag add fails. The PR description claims this scenario is "harmless" and "idempotent," but npm dist-tag add on a nonexistent version is an error, not a no-op. This causes a red ✗ on every fresh non-prerelease publish, creating noise and masking real failures.