fix: keep semver validation at release preflight

Codex review flagged that removing the per-PR gate also dropped the only
semver-format check. Validate the version in release.yml preflight, before
any images are pushed, and reword the README to match the actual procedure
(bump in a PR before dispatching).

Author: 16francej

.github/workflows/release.yml

@@ -29,7 +29,12 @@ jobs:
             echo "releases are cut from main; this run is on $GITHUB_REF" >&2
             exit 1
           fi
-          tag="v$(jq -r .version cli/package.json)"
+          version=$(jq -r .version cli/package.json)
+          case "$version" in
+            [0-9]*.[0-9]*.[0-9]*) ;;
+            *) echo "cli/package.json version must be semver, got $version" >&2; exit 1 ;;
+          esac
+          tag="v$version"
           if gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$tag" > /dev/null 2>&1; then
             echo "$tag is already released; bump cli/package.json before releasing again" >&2
             exit 1

cli/README.md

@@ -22,9 +22,9 @@ This package is published to npm as `@yc-software/qm`, with npm provenance attes
 building workflow. A release is one dispatch of `.github/workflows/release.yml` from
 `main`: it signs and pushes the first-party images, publishes the package pinning their
 digests, and then tags `v<version>` and creates the GitHub release with the resolved
-digests attached. The version comes from `cli/package.json`, bumped when a release is cut rather than by
-every pull request that touches the package; a tag that already exists stops the release
-rather than moving. The checked-in image manifest is a sentinel that
+digests attached. The version comes from `cli/package.json`, bumped in a PR before dispatching a release
+rather than by every pull request that touches the package; a tag that already exists
+stops the release rather than moving. The checked-in image manifest is a sentinel that
 a deployment overrides with real digests. The packed-artifact test exercises the consumer
 path locally.
 

test/release-workflows.test.ts

@@ -134,7 +134,9 @@ test("one dispatchable workflow drives the whole release, main-only and in order
 test("the release refuses a tag it already published and writes the tag last", () => {
   const workflow = readFileSync(".github/workflows/release.yml", "utf8");
 
-  assert.match(workflow, /tag="v\$\(jq -r \.version cli\/package\.json\)"/);
+  assert.match(workflow, /version=\$\(jq -r \.version cli\/package\.json\)/);
+  assert.match(workflow, /cli\/package\.json version must be semver/);
+  assert.match(workflow, /tag="v\$version"/);
   assert.match(workflow, /is already released; bump cli\/package\.json before releasing again/);
   assert.ok(
     workflow.indexOf("already released") < workflow.indexOf("gh release create"),