ci(release): Fix automated release process

[vishal-bala]

Summary

• Fix the release gate to retry PR association lookup when GitHub briefly lags after a merge, which was causing valid auto:release merges to be skipped
• Fix release creation by resolving the version once, tagging the bumped commit explicitly, and using auto release for notes instead of re-running auto shipit after the bot commit
• Publish from the resolved release tag rather than main so the built artifact matches the tagged release commit

Testing

• Not run (not requested)

---

Note

Medium Risk
Changes the GitHub Actions release/tagging flow and gating logic; mistakes could cause missed releases, incorrect tags, or publishing the wrong commit, but scope is limited to CI configuration.

Overview
Improves the release gate by retrying PR association lookup for the merge commit before deciding whether the auto:release label is present.

Reworks the release job to resolve the version once, commit the pyproject.toml bump, capture the resulting commit SHA, create/push an explicit vX.Y.Z tag (with safety checks), and generate GitHub release notes via auto release over the exact tag range.

Updates publishing to build from the newly created tag (using the release job’s version output) instead of main, ensuring the published artifact matches the tagged release commit.

^{Written by Cursor Bugbot for commit 92a754c. This will update automatically on new commits. Configure here.}

[jit-ci]

🛡️ Jit Security Scan Results

✅ No security findings were detected in this PR

---

^{Security scan by Jit}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b6879b2ac3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".