ci(release): skip CI on the version-bump squash commit on main (#3912)

* ci(release): skip CI on auto-generated version-bump PRs

Append `[skip ci]` to both the bump commit message and the
release-PR title in `release.yml` and `release-sdk.yml`.

The PR title doubles as the squash-merge commit message on `main`,
so adding `[skip ci]` there is required to skip CI when the release
PR is auto-merged into `main`.

Affected flows:
- release.yml      -> chore(release): vX.Y.Z
- release-sdk.yml  -> chore(release): sdk-typescript vX.Y.Z

These PRs only bump `package.json` / `package-lock.json` versions
and do not need the full lint/test/CodeQL matrix to run on PR open,
on the release branch push, or on the post-merge push to `main`.

* ci(release): make skip-ci squash subject explicit

* ci(release): scope skip-ci to the squash commit and bind RELEASE_TAG

Two follow-ups on the release-PR skip-ci change:

- Drop `[skip ci]` from the release-branch commit. Putting it there
  also suppressed `push: tags: [v*]` workflows because the release
  tag points at the release-branch tip, so `Build and Publish Docker
  Image` would silently skip when the release was tagged. Keeping the
  marker only on the squash subject preserves the "do not re-run CI
  on main" goal without affecting tag pushes.
- Export `RELEASE_TAG` to the `Enable auto-merge for release PR` step
  in both workflows. The step runs under `set -euo pipefail`, so the
  new `--subject` referencing `${RELEASE_TAG}` would otherwise crash
  with `unbound variable` and abort the merge.

.github/workflows/release-sdk.yml

@@ -399,7 +399,7 @@ jobs:
             pr_url="$(gh pr create \
               --base main \
               --head "${RELEASE_BRANCH}" \
-              --title "chore(release): sdk-typescript ${RELEASE_TAG}" \
+              --title "chore(release): sdk-typescript ${RELEASE_TAG} [skip ci]" \
               --body "Automated release PR for sdk-typescript ${RELEASE_TAG}.")"
           fi
 
@@ -411,9 +411,18 @@ jobs:
         env:
           GITHUB_TOKEN: '${{ secrets.CI_BOT_PAT }}'
           PR_URL: '${{ steps.pr.outputs.PR_URL }}'
+          RELEASE_TAG: '${{ steps.version.outputs.RELEASE_TAG }}'
         run: |-
           set -euo pipefail
-          gh pr merge "${PR_URL}" --squash --auto --delete-branch
+          # Keep [skip ci] on the squash commit that lands on main. The release
+          # PR title also includes it for visibility, but --subject makes the
+          # post-merge CI-skip behavior explicit instead of depending on gh's
+          # default squash subject.
+          gh pr merge "${PR_URL}" \
+            --squash \
+            --auto \
+            --delete-branch \
+            --subject "chore(release): sdk-typescript ${RELEASE_TAG} [skip ci]"
 
       - name: 'Create Issue on Failure'
         if: |-

.github/workflows/release.yml

@@ -435,7 +435,7 @@ jobs:
             pr_url="$(gh pr create \
               --base main \
               --head "${RELEASE_BRANCH}" \
-              --title "chore(release): ${RELEASE_TAG}" \
+              --title "chore(release): ${RELEASE_TAG} [skip ci]" \
               --body "Automated release PR for ${RELEASE_TAG}. Syncs package.json versions on main.")"
           fi
 
@@ -447,9 +447,18 @@ jobs:
         env:
           GITHUB_TOKEN: '${{ secrets.CI_BOT_PAT }}'
           PR_URL: '${{ steps.pr.outputs.PR_URL }}'
+          RELEASE_TAG: '${{ needs.prepare.outputs.release_tag }}'
         run: |-
           set -euo pipefail
-          gh pr merge "${PR_URL}" --squash --auto --delete-branch
+          # Keep [skip ci] on the squash commit that lands on main. The release
+          # PR title also includes it for visibility, but --subject makes the
+          # post-merge CI-skip behavior explicit instead of depending on gh's
+          # default squash subject.
+          gh pr merge "${PR_URL}" \
+            --squash \
+            --auto \
+            --delete-branch \
+            --subject "chore(release): ${RELEASE_TAG} [skip ci]"
 
   notify_failure:
     name: 'Notify Release Failure'