fix(release): keep finalize versions on main

[christso]

Summary

Finalizing a prerelease now leaves the stable package versions on main instead of only on a detached release tag. The release script still promotes the exact prerelease tag: it requires main to point at that tag before creating a new stable release commit, and it refuses to finalize if additional commits have landed first.

If a stable tag was already created by the old detached flow, rerunning finalize fast-forwards main to that existing release commit. The publish workflow now resolves and validates the prerelease tag without checking it out, so release.ts can commit and push the stable versions on main.

Validation

• bunx biome check scripts/release.ts
• bunx tsc --noEmit --target ES2022 --module NodeNext --moduleResolution NodeNext --types bun --strict --skipLibCheck scripts/release.ts
• bun -e "import { readFileSync } from 'node:fs'; import { parse } from 'yaml'; parse(readFileSync('.github/workflows/publish.yml', 'utf8'));"
• git diff --check
• Disposable local git release simulation:
  • old finalize left origin/main at 2.0.0-next.1 while pushing v2.0.0
  • new finalize pushed origin/main and v2.1.0 at stable version 2.1.0
  • existing stable tag recovery fast-forwarded origin/main to 2.2.0
  • finalize refused when main moved past v2.3.0-next.1

---

[cloudflare-workers-and-pages]

Deploying agentv with    Cloudflare Pages

Latest commit:	ddee077
Status:	✅  Deploy successful!
Preview URL:	https://2737618c.agentv.pages.dev
Branch Preview URL:	https://finalize-main-version.agentv.pages.dev

View logs