fix(MESHAGEN-010-2): 2 review findings in release.yml

[flamingo]

Closes 2 review findings in .github/workflows/release.yml.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

Warning

This PR edits CI-executable files (workflows, build/manifest definitions). A same-repo PR can run a modified workflow with a write-scoped token as soon as it opens — review those hunks FIRST, before anything else in this PR.

#	Fix confidence	Finding	Location
1	🟢 90 high	release.yml creates a GitHub Release automatically on push to master, not gated on workflow_dispatch	.github/workflows/release.yml:186
2	🟡 85 medium	release job lacks workflow_dispatch-only gate, enabling automatic release publication on push	.github/workflows/release.yml:208

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 6542cba8-5031-4f6a-9825-da6bc2c6e58e

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

[flamingo]

🦩 What this fix changed, finding by finding

2 finding(s) fixed in this draft — 2 explained inline on the diff.

[flamingo]

🦩 🔴 release.yml creates a GitHub Release automatically on push to master, not gated on workflow_dispatch

Added github.event_name == 'workflow_dispatch' && to the if: condition of the release job (line ~186), so the job (and its Create Release step using softprops/action-gh-release) will now only run when manually triggered via workflow_dispatch, not on push to master.

🤖 Prompt for AI agents

In .github/workflows/release.yml around line 186, review and complete this code-review fix: release.yml creates a GitHub Release automatically on push to master, not gated on workflow_dispatch.
What the draft fix changed: Added `github.event_name == 'workflow_dispatch' &&` to the `if:` condition of the `release` job (line ~186), so the job (and its `Create Release` step using `softprops/action-gh-release`) will now only run when manually triggered via workflow_dispatch, not on push to master.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 90 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🔴 release job lacks workflow_dispatch-only gate, enabling automatic release publication on push

Same edit as finding 1 (the release job's gating condition at line ~208 covers the Create Release step) ensures softprops/action-gh-release cannot execute on push events. Left prerelease: ${{ github.event_name == 'push' }} unchanged since the job can no longer run on push, making that expression dead but harmless; a more thorough fix could simplify/remove it, but doing so risks altering intended prerelease semantics beyond the scope of this finding.

🤖 Prompt for AI agents

In .github/workflows/release.yml around line 208, review and complete this code-review fix: release job lacks workflow_dispatch-only gate, enabling automatic release publication on push.
What the draft fix changed: Same edit as finding 1 (the `release` job's gating condition at line ~208 covers the `Create Release` step) ensures `softprops/action-gh-release` cannot execute on `push` events. Left `prerelease: ${{ github.event_name == 'push' }}` unchanged since the job can no longer run on push, making that expression dead but harmless; a more thorough fix could simplify/remove it, but doing so risks altering intended prerelease semantics beyond the scope of this finding.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 85 medium — react 👍/👎 to teach the reviewer