fix(release): use create-pull-request to satisfy main branch protection

[Copilot]

release.yml was pushing version-bump commits directly to main, which is blocked by two branch protection rules: required verified signatures and required PR review.

Changes

• Replace direct push with peter-evans/create-pull-request@v7 — commits created via the GitHub API are automatically verified (signed), and changes land via PR instead of a force push to main
• Tag the PR branch HEAD — use steps.cpr.outputs.pull-request-head-sha so the version tag points to the commit carrying the actual file changes, not the pre-bump main HEAD
• Prevent infinite loops on PR merge — extend the if guard to skip runs where the triggering push is the merge of an automated release PR:

  !(startsWith(github.event.head_commit.message, 'Merge pull request') &&
    contains(github.event.head_commit.message, 'release/v'))

• Add pull-requests: write permission — required to open the version-bump PR

---

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.