Semver releases cut with cargo-release; publish on v* tags only

cargo release <level> bumps, tags v<semver>, and pushes; publish.yml
reacts to the tag and attaches the artifact to that release. Plain
main pushes now run tests (test.yml) instead of publishing build-<sha>
artifacts on every push.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Cargo.toml

@@ -131,3 +131,12 @@ bin-default-features = false
 lib-features = ["hydrate"]
 lib-default-features = false
 lib-profile-release = "wasm-release"
+
+# cargo release <level> is how a portal version is cut: bump, commit,
+# tag v{{version}}, push. CI (publish.yml) reacts to the tag and
+# publishes the release artifact; nothing on crates.io.
+[package.metadata.release]
+publish = false
+push = true
+tag-name = "v{{version}}"
+pre-release-commit-message = "Release {{version}}"