ci: split release-please into independent release and PR creation steps

[keelerm84]

Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Related issues

Follows the pattern established in ld-relay PR #622 to support GitHub's immutable releases.

Describe the solution you've provided

Splits the single release-package job into two jobs (release-please + release-package) and uses a two-pass release-please invocation:

1. Pass 1 (skip-github-pull-request: true): Attempts to create a release. If successful, checks out the repo and pushes the tag explicitly (with an idempotency guard).
2. Pass 2 (skip-github-release: true): Only runs if no release was created. Handles PR creation/maintenance.
3. release-package job: Runs only when releases_created == 'true', containing all build/publish/attest steps without per-step if guards.

This separation is required because release-please checks for an existing tag to decide whether a release PR is still needed. Without the split, it could open a duplicate PR before the tag is available.

Items requiring careful review:

• The update-cabal step now references steps.release-prs.outputs.pr (from pass 2) instead of the old steps.release.outputs.pr (from pass 1). Since pass 1 uses skip-github-pull-request: true, it won't emit PR outputs — so update-cabal must use the pass 2 step ID. Verify this is correct.
• The checkout preceding update-cabal does not use fetch-depth: 0 (unlike the release-package job checkout). Confirm update-cabal doesn't require full history.
• update-cabal now only runs when no release was created (since pass 2 is skipped on release runs). Previously it ran whenever a PR existed, even during a release run. This should be fine (no PR to update during a release), but worth confirming.

Describe alternatives you've considered

Could keep a single job with per-step if conditions, but splitting into two jobs follows the established pattern across the org and makes the release-please logic self-contained.

Additional context

• The pinned SHA 16a9c90856f42705d54a6fda1823352bdc62cf38 is unchanged; only the version comment was updated from # v4 to # v4.4.0.
• The release-package job drops pull-requests: write since it no longer runs release-please.

Link to Devin session: https://app.devin.ai/sessions/7d5bda4d9dbe4ae0b950b30a50485e60
Requested by: @keelerm84

---

Note

Medium Risk
Changes the release workflow control flow (two-pass release-please, manual tag creation, and a new gated packaging job), which could impact how/when releases and release PRs are created. No product code changes, but misconfiguration could break releases or create missing/duplicate tags/PRs.

Overview
Splits the GitHub Actions release workflow into two jobs: a release-please job that decides whether to cut a GitHub Release or open/update a release PR, and a release-package job that runs build/publish/attestation only when a release was actually created.

release-please is now invoked twice: first to create the GitHub Release (with PR creation disabled) and, on success, explicitly creates/pushes the git tag with an idempotency check; second (only when no release was created) to manage release PRs and run update-cabal against the PR branch.

^{Reviewed by Cursor Bugbot for commit 407a6be. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

Closing: The split release-please pattern is only needed for repos with artifact uploads. This attestation-only repo doesn't need it. The attestation changes are in PR #106.