Fix release workflow

[mtmk]

The release workflow triggered on push to main, so any merged PR that changed version.txt would push packages to NuGet. Switch to the release: published event so publishing requires a maintainer to create a GitHub release, and validate the tag matches version.txt before packing.

[synadia-claude-reviewer]

Claude finished @mtmk's task in 1m 57s —— View job

---

PR Review: Fix release workflow

• Gather context
• Review workflow changes
• Post findings

---

The core change is a clear improvement: switching from push to release: published removes the accidental-publish risk where any version bump merged to main would trigger a NuGet push. The tag-vs-version.txt validation also adds a useful sanity check.

One issue worth fixing:

permissions: {} (line 8) explicitly sets all scopes to none. actions/checkout@v4 needs contents: read — this works today on a public repo via unauthenticated HTTPS, but would silently break if the repo were ever made private. Better to be explicit (see inline comment).

Other observations (no action needed):

• Removing dotnet 9.x from the SDK matrix is correct — src/Directory.Build.props targets netstandard2.0;netstandard2.1;net6.0;net8.0 only, so 9.x was unnecessary.
• ls -lh left in the Push step is harmless debug output and can be useful to confirm what's being uploaded.
• Tag stripping (${tag#v}) and the head -n 1 read are both correct; command substitution strips trailing newlines so the comparison is clean.
• The old contents: write permission (used to push git tags) is now correctly dropped since GitHub releases create tags automatically.

[Jarema]

LGTM!