fix(ci): restrict manual publish workflow execution to version branches

[twisti-dev]

Motivation

• Prevent exposure of publishing credentials and execution of repository-controlled build/publish code via workflow_dispatch by ensuring manual runs only execute against release branches.

Description

• Add a job-level guard in .github/workflows/publish.yml: if: github.event_name != 'workflow_dispatch' || startsWith(github.ref, 'refs/heads/version/') so manually-dispatched runs only proceed when the selected ref is a version/* branch while preserving existing push-trigger behavior.

Testing

• Programmatically inspected the updated .github/workflows/publish.yml and confirmed the diff contains only the single if: guard addition and the workflow still triggers on push to version/* branches.

---

Codex Task

[github-actions]

⚠️ API/ABI changes detected!

This PR contains changes that modified the public API. To update the reference ABI dumps:

./gradlew updateKotlinAbi
git add **/api/**
git commit -m "Update ABI reference"
git push

After updating, the CI will pass. Make sure the changes are backward compatible.

[mergify]

👋 twisti-dev your PR is conflicting and needs to be updated to be merged