ci: fix release pipeline — update actions, add GH releases, extend CI triggers (#1956)

- Update actions/checkout and actions/setup-node to v6 in release.yml and
  hotfix.yml (Node.js 24 compat, prevents June 2026 breakage)
- Add GitHub Release creation to release finalize, release RC, and hotfix
  finalize steps (populates Releases page automatically)
- Extend test.yml push triggers to release/** and hotfix/** branches
- Extend security-scan.yml PR triggers to release/** and hotfix/** branches

Closes #1955

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/hotfix.yml

@@ -190,6 +190,16 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
+      - name: Create GitHub Release
+        if: ${{ !inputs.dry_run }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.version }}
+        run: |
+          gh release create "v${VERSION}" \
+            --title "v${VERSION} (hotfix)" \
+            --generate-notes
+
       - name: Clean up next dist-tag
         if: ${{ !inputs.dry_run }}
         env:

.github/workflows/release.yml

@@ -208,6 +208,17 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
+      - name: Create GitHub pre-release
+        if: ${{ !inputs.dry_run }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PRE_VERSION: ${{ steps.prerelease.outputs.pre_version }}
+        run: |
+          gh release create "v${PRE_VERSION}" \
+            --title "v${PRE_VERSION}" \
+            --generate-notes \
+            --prerelease
+
       - name: Verify publish
         if: ${{ !inputs.dry_run }}
         env:
@@ -331,6 +342,17 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
+      - name: Create GitHub Release
+        if: ${{ !inputs.dry_run }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.version }}
+        run: |
+          gh release create "v${VERSION}" \
+            --title "v${VERSION}" \
+            --generate-notes \
+            --latest
+
       - name: Clean up next dist-tag
         if: ${{ !inputs.dry_run }}
         env: