ci: use release.prerelease flag instead of tag substring match

Replace contains(tag, '-rc') with github.event.release.prerelease
on Cloudsmith steps. This covers all prerelease formats (beta, alpha,
etc.) using GitHub release metadata instead of string parsing.

Also gate the mac-builds dispatch on non-prerelease to avoid wasting
signing cycles on RC builds.

Author: desimone

.github/workflows/release.yaml

@@ -124,12 +124,12 @@ jobs:
           echo "pkgversion=$(echo  ${TAG#v} | tr '-' '~')" >> $GITHUB_OUTPUT
 
       - name: Install Cloudsmith CLI
-        if: "!contains(steps.tagName.outputs.tag, '-rc')"
+        if: "!github.event.release.prerelease"
         run: |
           pip3 install cloudsmith-cli
 
       - name: Publish to Cloudsmith
-        if: "!contains(steps.tagName.outputs.tag, '-rc')"
+        if: "!github.event.release.prerelease"
         env:
           CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
         working-directory: dist/
@@ -177,6 +177,7 @@ jobs:
           VERSION: "${{ github.event.release.tag_name }}"
 
       - name: trigger mac signed and notarized builds
+        if: "!github.event.release.prerelease"
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697
         with:
           repository: pomerium/mac-builds