chore(ci): drop push-to-main publish trigger — dispatch-only (#91)

The push trigger fired on every release-PR squash-merge to main,
attempting to publish a version that workflow_dispatch on the prep
branch had already published — producing a 400 "node version already
exists" failure and a cosmetic red badge on the merge commit. With
the dispatch-from-prep-branch flow now standard (per CLAUDE.md and
releasing.md), the push trigger is redundant.

Updates docs/maintainers/releasing.md to match: drops the stale
"trade-off" callout (whose premise was the auto-publish on merge),
replaces the two anti-patterns whose rationale was the auto-trigger
with a single "don't forget to dispatch" reminder.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/publish.yml

@@ -1,12 +1,6 @@
 name: Publish to Comfy registry
 on:
   workflow_dispatch:
-  push:
-    branches:
-      - main
-      - master
-    paths:
-      - "pyproject.toml"
 
 permissions:
   issues: write

docs/maintainers/releasing.md

@@ -77,10 +77,9 @@ If publish fails:
 | `409` / duplicate version | The version already exists in the registry | Bump `pyproject.toml` to a new version, update `CHANGELOG.md`, force-push the PR branch, re-validate. |
 | Auth 401/403 | Secret missing | Set `REGISTRY_ACCESS_TOKEN` in repo Settings → Secrets, or via `gh secret set REGISTRY_ACCESS_TOKEN --repo malkuthro/ComfyUI-Koolook`. |
 
-> **Trade-off:** validating before merge means the auto-triggered publish
-> on the merge commit will 409 (duplicate version), leaving a cosmetic
-> red badge on the merge. This is intentional — better to catch a broken
-> publish in PR review than after release.
+A successful dispatch *is* the publish — `publish-node-action@v1` has no
+dry-run mode. Once the run is green, the version is sealed on the Registry
+and the merge afterward is just sealing the branch state.
 
 ### 4. Squash-merge
 
@@ -130,9 +129,7 @@ gh release create vX.Y.Z --title "vX.Y.Z" \
   `publish.yml` was masked by the misleading `Failed to validate token`
   error. The registry check (`curl /publishers/<id>`) is the only way to
   catch a `PublisherId` mismatch before users do.
-- **Do not commit a release directly to `main`.** Release PRs trigger the
-  publish workflow on push to `main`; doing it via PR keeps that auto-run
-  associated with a reviewable change.
-- **Do not edit `pyproject.toml` for non-release reasons in a release PR.**
-  The publish workflow triggers on any `pyproject.toml` change. Keeping
-  release PRs scoped to version + changelog avoids surprise publishes.
+- **Do not forget the dispatch step.** `publish.yml` is `workflow_dispatch`
+  only — merging a release PR no longer auto-publishes. If you skip step 3
+  the version never reaches the Registry; ComfyUI-Manager will keep
+  reporting the previous release.