fix(ci): make release promotion skip-proof

[Arbousier1]

Root cause

GitHub skips pull_request workflows when the pull request HEAD commit contains a CI skip marker. The validated #93 merge intentionally used [skip ci], so closing the subsequent dev-to-main promotion did not create the Release run.

Fix

• trigger the release promotion gate with pull_request_target: closed
• retain the existing strict guard: merged, same repository, head dev, base main
• keep build jobs read-only; contents: write remains isolated to the final trusted release job

GitHub documents pull_request_target: closed as the merge trigger and explicitly states that CI skip annotations do not suppress pull_request_target runs.

Validation

• independent security review found no must-fix or untrusted-write-token path
• git diff --check passed
• no local build was run, per repository validation policy