Release workflow security logic

[cursor]

Bare minimum self-checks

What do you think of a person who only does the bare minimum?

• I've updated this PR with the latest code from main
• I've done a cursory QA pass of my code locally
• I've ensured all automated status check and tests pass
• I've connected this PR to an issue

Pieces of flare

• I've written a unit or functional test for my code
• I've updated relevant documentation it my code changes it
• I've updated this repo's README if my code changes it
• I've updated this repo's CHANGELOG with my change unless its a trivial change (like updating a typo in the docs)

Finally

• I've requested a review with relevant people

If you have any issues or need help please join the #contributors channel in the Lando slack and someone will gladly help you out!

You can also check out the coder guide.

---

This PR addresses two issues in the release.yml GitHub Actions workflow:

1. Script injection via tag_name in shell command: Mitigated a high-severity security vulnerability by passing github.event.release.tag_name via an environment variable to prevent shell injection when running npm dist-tag add.
2. Editing older release regresses npm latest tag: Fixed a medium-severity logic bug by modifying the promote job's condition to only trigger if a release's prerelease status explicitly changes from true to false, preventing the latest npm tag from regressing when older releases are merely edited.

---

[cursor]

Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch.
_{Learn more about Cursor Agents}

[cursor]

Automatically closed this PR because it was created by Bugbot autofix for #229, and that PR was closed.