Fix release update checks and gate publishing

[Manho]

Summary

• use the latest published GitHub Release as the update source
• link GitHub-installed users to the verified release ZIP instead of main.zip
• share semantic version comparison between browser and release tooling
• require release PRs to merge into main before a tag and GitHub Release can be published
• rebuild and validate release assets from the merged release commit

Root cause

Release tags and assets were created from release/* branches without merging their version metadata back into main. The extension update checker read main/manifest.json, so it could report stale version information and linked users to a source archive rather than the packaged release asset.

Impact

GitHub-installed users now receive update information from releases/latest and a direct link to the packaged release ZIP. Chrome Web Store installations continue to hide manual update controls and no longer make an unnecessary GitHub update request from the settings page.

The release preparation workflow now always starts from main. A separate manual publish workflow verifies the merged release PR, release metadata, changelog, tag availability, and current main commit before creating an annotated tag and GitHub Release.

Validation

• npx vitest run --exclude='tests/e2e/**' (316 tests)
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/*.yml
• RELEASE_VERSION=1.2.6 ... npm run release:prepare:dry-run
• npm run release:package
• browser verification for update available, up to date, API failure, and Chrome Web Store states

Repository settings

The Protect Main Branch and Protect Release Tags rulesets must be enabled separately after this PR is merged.