ci: auto-cut releases on merge to main (Tauri)

[statik]

Recreates #9 against the Tauri/Rust main (the Go implementation it was built on was removed during the v2 migration). Architecture is unchanged from the approved design; only the build hand-off was re-fit to the Tauri pipeline.

Summary

• version.yml — on push to main, computes the next semver from Conventional Commits (mathieudutour/github-tag-action dry-run) and calls release.yml in the same run. No tag/commit pushed back to main → no secret, no release loop.
• build/ci/clamp_version.sh — keeps the project in 0.x until 1.0.0 is shipped deliberately (feat!: bumps minor, not major). 8 unit tests.
• release.yml (reusable) — a create-release job pre-creates the draft once and resolves the version across all triggers; the macOS/Windows build jobs write the version into src-tauri/tauri.conf.json (not committed) and upload to the draft by releaseId (avoids the tauri-action create-by-tag race, #914); a publish job flips the draft to published on the auto path. Manual dispatch / tag-push stay drafts.
• pr-title.yml — lints PR titles as Conventional Commits (squash-merge makes the title the commit subject the versioner reads).

Versioning

Merge	Result
feat:	minor (0.1.0→0.2.0)
fix:	patch
feat!: / breaking	minor, clamped to 0.x (not 1.0.0)
docs:/chore: only	no release

Validation

• actionlint clean on version.yml/pr-title.yml; release.yml only carries the pre-existing Apple-signing SC2086 inherited verbatim from main
• zizmor: new workflows clean except the intentional secrets: inherit on version.yml; release.yml has 1 unpinned-use (rust-toolchain@stable, main's moving ref) — fewer than main (both checkouts now SHA-pinned)
• clamp_version_test.sh 8/8; shellcheck/shfmt clean
• Cannot be exercised on this PR — version.yml triggers on push to main and release.yml's workflow_call only fires from it, so the release path is first tested on the initial post-merge feat:/fix: merge

Notes / known tradeoffs

• Per the no-secret approach, the in-repo tauri.conf.json (and Cargo.toml) version stays 0.1.0; git tags are the source of truth and the bundle version is injected at build time. If the app surfaces CARGO_PKG_VERSION at runtime, that would need a committed bump (separate decision).
• Pre-existing lint debt in main's release build (Apple-signing SC2086, rust-toolchain@stable unpinned) left as-is — out of scope.

Replaces #9.

https://claude.ai/code/session_01JzTDM3mjWKS2XWbTFixBnk