DRIVERS-3601 Push release refs atomically

[blink1073]

Summary

• Create the version-bump commit and both tags (immutable version tag, floating v3 if applicable) locally and verify them before touching the remote.
• Push the branch and both tags together with git push --atomic, so a failure at any point leaves the remote exactly as it was before the run and a plain rerun is safe.

Why

Follow-up to #115. The dry-run release process there surfaced two related gaps: pushing the version-bump commit before the tag exists (a rerun after a tag-creation failure hits "nothing to commit" and can never progress), and pushing the immutable tag before the floating v3 tag update (a rerun after that failure silently computes the next version instead of finishing the current one). Both come from treating three sequential pushes as if they were one operation. Making the push itself atomic removes the partial-state problem instead of working around it.

Test plan

• next-version.sh/bump-major-version.sh test suites still pass (unaffected by this change)
• YAML validity and shellcheck clean locally
• Verified git push --atomic against a local bare repo for both the v3 (patch/minor bump) and non-v3 (major bump) paths
• Live verification against a real release, alongside the rest of Task 6

[Copilot]

🟢 Approval recommended

The workflow change aligns with the stated goal of avoiding partial remote state, and the remaining feedback is a maintainability improvement rather than a correctness blocker.

Pull request overview

This PR updates the repository’s release workflow to push the version-bump commit and release tags as a single atomic operation, preventing partially-updated remote state when a release run fails mid-push.

Changes:

• Stop pushing the version-bump commit and immutable version tag in their respective steps; create/verify them locally instead.
• Add a single “Push release refs” step that pushes the branch and all relevant tags together via git push --atomic.
• Update the floating-tag retirement warning message to reflect the new “push refs” flow.

File summaries

File	Description
.github/workflows/release.yml	Defers all remote ref updates until one atomic push of main + release tag(s), eliminating partial remote state during releases.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

It modifies the production release process semantics (atomic multi-ref push) and warrants a final human review given the operational impact if the workflow behavior differs on GitHub’s remote.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0 new
• Review effort level: Lite

[blink1073]

@GromNaN this is a small bug fix on top of #115