docs: cold architectural audit + publish workflow fix

.github/workflows/publish.yml

@@ -103,6 +103,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: main
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - uses: actions/setup-node@v4
@@ -125,13 +126,18 @@ jobs:
         run: |
           git checkout -- package-lock.json
           CURRENT=$(node -p "require('./package.json').version")
-          OVERRIDE="${{ inputs.version-override }}"
-          if [ -n "$OVERRIDE" ] && [ "$CURRENT" = "$OVERRIDE" ]; then
-            echo "Version already at $OVERRIDE — skipping bump"
-          elif [ -n "$OVERRIDE" ]; then
-            npx commit-and-tag-version --release-as "$OVERRIDE"
+
+          if [ "${{ github.event_name }}" = "release" ]; then
+            echo "Triggered by release event — using existing version $CURRENT"
           else
-            npx commit-and-tag-version
+            OVERRIDE="${{ inputs.version-override }}"
+            if [ -n "$OVERRIDE" ] && [ "$CURRENT" = "$OVERRIDE" ]; then
+              echo "Version already at $OVERRIDE — skipping bump"
+            elif [ -n "$OVERRIDE" ]; then
+              npx commit-and-tag-version --release-as "$OVERRIDE"
+            else
+              npx commit-and-tag-version
+            fi
           fi
           echo "new_version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"
 
@@ -195,7 +201,7 @@ jobs:
         run: npm publish --access public --provenance
 
       - name: Push version commit and tag
-        if: "!inputs.dry-run"
+        if: github.event_name == 'workflow_dispatch' && !inputs.dry-run
         run: |
           git push origin main
           git push origin "v${{ steps.version.outputs.new_version }}"