fix(ci): switch execute-release to push trigger + commit-msg gate (#800)

pull_request:closed fires for every PR merged to main, and when all
jobs have false if: conditions GitHub reports startup_failure instead
of a clean skip. Adopted the bluefin-lts pattern:

- Trigger on push:main and workflow_dispatch
- check-trigger job reads the squash-merge commit message
- execute only runs when message starts with
  'ci: promote testing images to stable'
- workflow_dispatch always runs execute (manual re-trigger path)
- Proper top-level permissions (superset of all job needs)

Fixes the startup_failure that has affected every run since the
workflow was introduced on 2026-06-09.

Assisted-by: Claude Sonnet 4.5 via pi

Author: castrojo

.github/workflows/execute-release.yml

@@ -1,9 +1,7 @@
 name: Execute Release
 
 on:
-  pull_request:
-    types:
-      - closed
+  push:
     branches:
       - main
   workflow_dispatch:
@@ -17,11 +15,27 @@ permissions:
   pull-requests: write
 
 jobs:
+  check-trigger:
+    runs-on: ubuntu-latest
+    outputs:
+      is-promotion: ${{ steps.check.outputs.is-promotion }}
+    steps:
+      - id: check
+        env:
+          COMMIT_MSG: ${{ github.event.head_commit.message }}
+          EVENT_NAME: ${{ github.event_name }}
+        run: |
+          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            echo "is-promotion=true" >> "$GITHUB_OUTPUT"
+          elif echo "$COMMIT_MSG" | grep -q "^ci: promote testing images to stable"; then
+            echo "is-promotion=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "is-promotion=false" >> "$GITHUB_OUTPUT"
+          fi
+
   execute:
-    if: >-
-      github.event_name == 'workflow_dispatch' ||
-      (github.event.pull_request.merged == true &&
-      github.event.pull_request.head.ref == 'auto/promote-testing-to-main')
+    needs: [check-trigger]
+    if: needs.check-trigger.outputs.is-promotion == 'true'
     permissions:
       actions: read
       contents: write
@@ -43,6 +57,7 @@ jobs:
     needs: [execute]
     if: always() && needs.execute.result == 'success'
     permissions:
+      actions: read
       contents: write
       id-token: write
       packages: read