ci: cut releases from a workflow that runs release.sh

[eddietejeda]

Why

Releases still needed a laptop: run release.sh prepare, wait for the PR, then run release.sh publish from a clean main checkout. The Python SDK already cuts releases from CI; this brings the Rust crate to the same flow.

What

• .github/workflows/cut-release.yml (mirrors sdk-python's workflow):
  • workflow_dispatch with a bump input runs the existing ./scripts/release.sh prepare, which bumps Cargo.toml, rolls [Unreleased] into a versioned changelog section, pushes release/vX.Y.Z, opens the PR, and then enables squash auto-merge on it.
  • When a release/v* PR merges, the Tag release job runs the existing ./scripts/release.sh publish, which tags main. The tag push triggers publish.yml (crates.io) and release.yml (GitHub Release) exactly as before.
  • Uses the hotdata-automation App token so the release PR gets CI and the tag triggers workflows (GITHUB_TOKEN events trigger nothing). All actions are SHA-pinned to the versions already used in this repo; cargo-edit is installed with a pinned taiki-e/install-action.
• scripts/release.sh: only the usage text, PR body, and final echo now describe the CI path. No logic changes.
• RELEASING.md: release steps now point at the workflow; adds a "Recover a missing tag" section; keeps the GitHub Release recovery section.

Releasing afterwards

gh workflow run cut-release.yml -f bump=minor   # or patch | major | X.Y.Z

[claude]

nit: Move concurrency from the workflow level to the publish and prepare jobs (not blocking).

The workflow-level group applies to every closed PR on main, including runs where both jobs skip. GitHub keeps one running and one pending run per group. A newer pending run cancels the older pending run, even with cancel-in-progress: false. A release-PR merge run can wait behind another close event. A third close event then cancels the release run, and no tag is pushed. Job-level concurrency only applies to jobs that pass their if, so unrelated PR closes never enter the group.

[claude]

nit: Pass inputs.bump through env instead of ${{ }} in the script (not blocking).

The runner expands ${{ inputs.bump }} into the shell source before release.sh validates the value. A value with " or $(...) runs as shell code with the App token in the environment. GitHub's script-injection hardening guide recommends an intermediate environment variable.

Suggested change

	env:
	GH_TOKEN: ${{ steps.app-token.outputs.token }}
	run: ./scripts/release.sh prepare "${{ inputs.bump }}"
	env:
	GH_TOKEN: ${{ steps.app-token.outputs.token }}
	BUMP: ${{ inputs.bump }}
	run: ./scripts/release.sh prepare "$BUMP"