ci: trigger publish/release on version tags only

[devin-ai-integration]

Summary

publish.yml and release.yml both triggered on push to main and on v*.*.* tags. During the 0.4.1 release that meant cargo publish ran twice: the merge to main published, then the tag run failed with error: crate scim_v2@0.4.1 already exists on crates.io index. Publishing on a main push is also wrong in principle — any non-release commit to main attempted a publish.

Both workflows now trigger on tags only, so the release is driven solely by pushing v<version>:

on:
  push:
    tags: ["v*.*.*"]

release.yml's if: startsWith(github.ref, 'refs/tags/v') guard is dropped since it's now redundant.

Added a guard in publish.yml that fails fast if the tag doesn't match Cargo.toml, so a mistyped tag can't publish the wrong version:

crate_version=$(grep '^version = ' Cargo.toml | cut -d'"' -f2)
[ "$crate_version" = "${GITHUB_REF_NAME#v}" ] || exit 1

Release process after this: merge the version bump, then push the v<version> tag.

Link to Devin session: https://app.devin.ai/sessions/15892de8aceb410ab92791f60c1d8d7e
Requested by: @shiftcontrol-dan

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring