Prevent publish workflows from failing on protected branch push-back

[Copilot]

The publish job was failing after package publication because the workflow attempted to commit and push release metadata directly to protected main. This updates the publish workflows to stop mutating the branch during release execution while preserving in-run packaging metadata preparation.

• Root cause

  • workflow_dispatch runs prepared release metadata, then executed:

    git push origin "HEAD:${GITHUB_REF_NAME}"

  • On dispatches from main, that became a direct push to a branch guarded by repository rules, causing GH013.

• Workflow changes

  • Removed the post-publish commit/push-back step from:
    • .github/workflows/aria-cli-publish-packages.yml
    • .github/workflows/aria-auth-core-publish.yml
  • Kept release metadata preparation available inside the runner for packaging during manual publishes.
  • Reduced workflow repo permission from contents: write to contents: read.

• Release process docs

  • Updated:
    • src/aria-cli/RELEASING.md
    • src/aria-auth-core/RELEASING.md
  • Clarified that manual publish runs may prepare changelog/version metadata transiently for packaging, but persisted metadata updates must land through a pull request.

• Scope control

  • Applied the same fix to the auth-core publish workflow because it used the same protected-branch-unsafe push-back pattern and would fail the same way.

Example of the removed failure path:

- name: Commit release metadata updates
  run: |
    git commit -m "chore(release): update metadata"
    git push origin "HEAD:${GITHUB_REF_NAME}"