Optimize CI workflow: separate tests and release

[rh0dium]

Summary

• Move release job to separate release.yml triggered only on master push
• Add PR verification to release workflow (prevents releases from admin bypasses)
• Rename job display names to generic: Lint, Security, Coverage
• Skip expensive jobs (tests, coverage, outdated) on merge queue branches
• Keep Lint and Security running for merge queue status checks

How it works

1. Push to feature branch → Full tests run (Lint, Security, tests, Coverage)
2. Click "Merge when ready" → Waits for Coverage to pass
3. Merge queue → Only Lint + Security run (~30s)
4. Merge to master → Release workflow verifies PR + creates release (~40s)

Test plan

• Verify Lint, Security, Coverage checks run on feature branch
• Verify merge queue only runs Lint and Security
• Verify release workflow creates release after merge

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.46%. Comparing base (3153797) to head (f7ce042).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master       #6   +/-   ##
=======================================
  Coverage   73.46%   73.46%           
=======================================
  Files           4        4           
  Lines         196      196           
  Branches       24       24           
=======================================
  Hits          144      144           
  Misses         42       42           
  Partials       10       10           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.