Rework CI workflow for releases

[jserv]

Switch the GitHub Actions workflow to a two-stage build/release pipeline: the build job runs on every push and PR to main, while the release job is gated on direct pushes to main only. This prevents the previous behavior where tag_name: ${{ github.ref_name }} would create a release tagged "main" on every push.

---

Summary by cubic

Reworks CI into a two-stage build/release pipeline. Builds the PDF on pushes and PRs to main (and manual runs), and publishes a prerelease tagged latest only on direct pushes to main, fixing accidental releases tagged "main".

• Bug Fixes

  • Stop creating releases tagged "main" on every push by gating the release job to pushes on main and using a stable latest tag that is force-moved to the current commit.

• Refactors

  • Split workflow into build (push/PR to main, plus workflow_dispatch) and release (push to main only) jobs.
  • Build inside a pinned texlive/texlive@sha256:... container; add wget and mark the workspace as a safe Git directory for container runs.
  • Cache TeX intermediates and upload concurrency-primer.pdf as an artifact for release; verify the output exists.
  • Add concurrency cancellation and default read-only permissions; grant contents: write only for release; upload build logs on failure.

^{Written for commit 0f85a0d. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 1 file