Fix release workflow for branch protection

[svperfecta]

Summary

• Removes the version bump (npm version patch) and direct commit push to main from the release workflow, which was blocked by org-level branch protection rules.
• The workflow now reads the current version from package.json instead of bumping it, and only pushes a lightweight git tag.
• Version bumps are expected to happen in PRs going forward, keeping the release workflow limited to tagging and creating the GitHub release.

Test plan

• Trigger the Release workflow manually via workflow_dispatch on the main branch with sample release notes.
• Verify that the workflow reads the version from package.json correctly.
• Verify that a lightweight tag (e.g., v1.0.1) is created and pushed.
• Verify that a GitHub release is created with the provided release notes.
• Confirm no commits are pushed to main by the workflow.

🤖 Generated with Claude Code