release: revert to tag-triggered publish; use RubyGems OIDC credentials + gem build/push (no API key)

Author: masterkain

.github/workflows/release.yaml

@@ -2,24 +2,27 @@ name: Release
 
 on:
   push:
-    branches: [ main ]
+    tags:
+      - v*
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
   id-token: write
 
 jobs:
   release:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
           ruby-version: '3.4'
-          bundler-cache: true
-      - name: Publish to RubyGems (trusted publishing)
-        uses: rubygems/[email protected]
+          bundler-cache: false
+      - name: Configure RubyGems credentials (OIDC)
+        uses: rubygems/[email protected]
+      - name: Build gem
+        run: gem build *.gemspec
+      - name: Push gem
+        run: gem push *.gem