chore: Improve release trigger handling

[davidkna-sap]

Context

Replaces #2148.

We no longer need a single entry workflow for canary releases and can use different envs for canary and stable releases: https://github.blog/changelog/2026-09-03-multiple-trusted-publishing-configurations-for-npm/

What this PR does and why it is needed

[hyperspace-pr-bot]

Summary

The following content is AI-generated and provides a summary of the pull request:

---

Chore: Improve Release Trigger Handling

Context

Replaces #2148.

What this PR does and why it is needed

This PR refactors the release workflows by taking advantage of GitHub's support for multiple trusted publishing configurations for npm. This eliminates the need for a single entry-point publish.yml workflow that dispatched to both canary and stable release workflows.

Key changes:

• publish-canary.yml: Changed from workflow_call to direct triggers (schedule and workflow_dispatch), switched to a dedicated canary-release environment (instead of the shared release environment), and fixed the default tag fallback (inputs.tag || 'canary') to handle scheduled runs where no input is provided.

• publish-release.yml: Changed from workflow_call to a direct release: [published] trigger, removing the need to pass secrets explicitly. Also adds a new refresh-context7 job that triggers a Context7 documentation refresh after a successful NPM publish.

• publish.yml: Removed entirely, as it is no longer needed as a central dispatcher.

• .github/zizmor.yml: Removed the dangerous-triggers ignore rule for dependabot-pnpm-lock.yml since the previously flagged workflow has been removed.

---

• 🔄 Regenerate and Update Summary
• ✏️ Insert as PR Description (deletes this comment)
• 🗑️ Delete comment

PR Bot Information

Version: 1.31.13

• Correlation ID: 266cfae0-a837-11f1-9c1c-884beee6cfb8
• Summary Prompt: Default Prompt
• File Content Strategy: Full file content
• Output Template: Repository PR Template
• Event Trigger: pull_request.opened
• LLM: anthropic--claude-4.6-sonnet
• GithubContextProvider: chore: don't require approval on scheduled canary releases #2148

[davidkna-sap]

This still requires changes to repo + npm.