fix: validate release branch version is semver before using it

The `release-` prefix match was too broad — branches like
`release-proposer` would set PRETEND_VERSION to `proposer`,
breaking the build. Now validate that the suffix matches
`^[0-9]+\.[0-9]+\.[0-9]+` before treating it as a version.

Co-authored-by: Cursor AI <ai@cursor.sh>
Co-authored-by: Anthropic Claude Opus 4 <claude@anthropic.com>

Author: 3 people

.github/workflows/test.yml

@@ -28,7 +28,9 @@ jobs:
         if: startsWith(github.head_ref || '', 'release-')
         run: |
           VERSION="${GITHUB_HEAD_REF#release-}"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          if [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+ ]]; then
+            echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          fi
 
       - uses: hynek/build-and-inspect-python-package@fe0a0fb1925ca263d076ca4f2c13e93a6e92a33e # v2.17.0
         env:
@@ -171,19 +173,26 @@ jobs:
         id: version
         run: |
           VERSION="${GITHUB_HEAD_REF#release-}"
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+ ]]; then
+            echo "::notice::Branch $GITHUB_HEAD_REF is not a release version branch — skipping."
+            exit 0
+          fi
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        if: steps.version.outputs.version
         with:
           persist-credentials: false
 
       - name: Download built packages
+        if: steps.version.outputs.version
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: Packages
           path: dist
 
       - name: Create or update draft release
+        if: steps.version.outputs.version
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |