Add automated gem release via RubyGems trusted publishing

[benrfairless]

Description

Adds automated publishing to rubygems.org using RubyGems trusted publishing (OIDC — no long-lived API keys):

• New .github/workflows/release.yml, triggered by pushes to main that touch lib/morph-cli/version.rb (plus workflow_dispatch)
• A check job reads MorphCLI::VERSION and queries the rubygems.org versions API; publishing is skipped when that version is already released, guarding against republishing
• The release job runs in a rubygems environment with id-token: write + contents: write and uses rubygems/release-gem@v1, which runs rake release: builds the gem, creates and pushes the vX.Y.Z tag, and publishes via trusted publishing
• README gains a "Releasing a new version" section with exact version-bump steps, and documents the one-time trusted publisher setup a gem owner must perform on rubygems.org (repository owner openaustralia, repository morph-cli, workflow filename release.yml, environment rubygems) plus creating the matching GitHub environment

Net effect: a version bump merged to main results in a published gem; merges that don't change the version are a no-op.

Motivation and Context

Releases are currently manual (rake release from a maintainer's machine with an API key). Trusted publishing removes key management, and the workflow makes releasing a normal reviewed PR. Part 5 (final) of the modernisation series.

How Has This Been Tested?

• Checked affected area manually on my own / staging system
• Ran automated tests on my own system
• Confirmed it passed the GitHub actions tests

The republish guard was verified against the live rubygems.org API for both the already-published (0.2.5 → skip) and unpublished (0.3.0 → release) cases. Workflow YAML validated; bundle exec rspec and bundle exec rubocop remain green. The publish job itself can only be exercised after a gem owner completes the one-time trusted publisher setup described in the README — it will no-op safely (check job) until a version bump lands.

Screenshots (if appropriate):

N/A

Types of Changes

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.

Action required after merge

A gem owner must configure the trusted publisher on rubygems.org and create the rubygems GitHub environment — steps are in the README section added by this PR. Until then the workflow cannot publish.

---

Part 5 of the 5-PR modernisation series. Stacked on #20 (base branch chore/update-gem-metadata); GitHub will retarget as the stack merges. Merge order: #17 → #18 → #19 → #20 → this.

Assisted-by: opencode/anthropic.claude-fable-5

[ianheggie-oaf]

Approved - LGTM at a glance

[sentry]

Bug: The release workflow's use of persist-credentials: false will cause the git tag push to fail during rake release, leaving the repository without a tag for the published gem.
_{Severity: CRITICAL}

Suggested Fix

In the release job, change persist-credentials: false to persist-credentials: true within the actions/checkout step. This will ensure the GITHUB_TOKEN is available in the git credential store, allowing the rake release command to successfully authenticate and push the release tag.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: .github/workflows/release.yml#L65-L66

Potential issue: The `release` job in the workflow uses `actions/checkout` with
`persist-credentials: false`. This prevents the `GITHUB_TOKEN` from being stored in the
local git configuration. The subsequent `rubygems/release-gem@v1` action executes
`bundle exec rake release`, which attempts to push a git tag to the repository. Since no
git credentials are configured, the `git push` command will fail with an authentication
error. This failure occurs after the gem has already been published to RubyGems.org,
leading to an inconsistent state where a gem version exists without a corresponding git
tag in the source repository.