fix(release): stop patch-release-me double-bumping ql/hotspots

[felickz]

Why

ql/hotspots/ is deliberately excluded from .release.yml's pack-version
location (added in #158/d0b969e - it's a separate package published by its
own manual workflow_dispatch, not part of the per-language pack family),
yet it kept getting bumped in lockstep with every release anyway (0.2.4 →
0.3.0 in #173, 0.2.1 → 0.2.4 in #169 before that).

Root cause

Confirmed by running the exact pinned patch-release-me image locally with
--debug, against both a minimal repro and a full copy of this repo's real
qlpack.yml files:

1. patch-release-me ships its own hardcoded default location for the
   CodeQL ecosystem, literally named "CodeQL Packs" (see its
   src/defaults.yml), matching **/qlpack.yml with only its own
   excludes: [/.codeql/]. Our custom location was named "CodeQL Pack Versions" — a different name — so the config loader only adds its
   built-in default alongside ours instead of treating ours as an override
   (it only skips the default when a location with the exact same name
   already exists). The built-in default has no idea about our
   ql/hotspots/ exclude, so it bumps that file regardless of what we
   configured.
2. Our own location's pattern has never actually matched anything, ever.
   ^version:\s*{version}$ anchors ^/$ to the whole file (not each
   line) without a (?m) multiline flag, and version: is never the
   literal first/last byte of a real multi-line qlpack.yml. All real
   bumping across every pack has silently been done by the built-in default
   this whole time — which is exactly why our exclude never took effect.

Fix

Two one-line changes to .release.yml, verified together locally against
all 28 real qlpack.yml files in this repo (with their actual LF line
endings, matching what CI/the Linux Docker image actually sees):

• Rename our location to exactly "CodeQL Packs", so patch-release-me's
  default-merge logic skips adding its conflicting built-in default instead
  of running both.
• Add the (?m) flag so the anchor actually works per-line, keeping the
  original anti-partial-match protection (e.g. a bump of 0.2.2 incorrectly
  matching inside 0.2.20) while actually working at all.

Verified: re-running bump -m minor against a real copy of this repo's
28 tracked qlpack.yml files (extracted via git cat-file to avoid a
Windows CRLF checkout artifact that produced a false negative on the first
attempt) - all 20 real packs bump 0.2.4 → 0.3.0 correctly,
ql/hotspots/qlpack.yml stays untouched, .release.yml itself still
bumps.

Also in this PR

• Reverted ql/hotspots/qlpack.yml's unintended version bump directly on
  chore: bump pinned CodeQL CLI to v2.22.4 and release v0.3.0 #173 (separate commit there) to unblock that release without waiting on
  this fix.
• Documents the "CodeQL Packs" name + (?m) pattern requirements in
  CONTRIBUTING.md's "Cutting a release" section, so a future edit doesn't
  silently reintroduce this.

[Copilot]

Pull request overview

This PR fixes the repo’s automated release bumping configuration so 42ByteLabs/patch-release-me updates only the intended qlpack.yml versions and does not inadvertently bump the separately-managed ql/hotspots package. It also documents the key configuration constraints to prevent regressions.

Changes:

• Renames the .release.yml location to CodeQL Packs to override (rather than coexist with) patch-release-me’s built-in default location for the CodeQL ecosystem.
• Updates the pack-version matching regex to use (?m) so ^...$ anchors apply per-line and actually match version: in real multi-line qlpack.yml files.
• Adds an IMPORTANT note in CONTRIBUTING.md documenting the required location name and regex behavior, and reiterates why ql/hotspots/ must remain excluded.

Show a summary per file

File	Description
CONTRIBUTING.md	Documents the required .release.yml location name and multiline regex requirement, plus why ql/hotspots/ must remain excluded.
.release.yml	Adjusts the location name and regex pattern so releases bump the intended packs and avoid ql/hotspots/.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Low