fix: gate automatic publishing on version changes

[jan-kubica]

Summary

• make VERSION the sole automatic publish trigger
• retain explicit workflow_dispatch for intentional recovery publishes
• enforce the trigger contract with a repository invariant test and generated contributor guidance

Validation

• bun run sync-ai
• bunx oxfmt --check .
• bun run lint:ws
• bun run typecheck
• bun run lint
• bun run format:check
• bun test
• bun run knip
• bun run build
• bun run intent:validate
• bun run pack:verify
• git diff --check

CC on behalf of @jan-kubica

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.