Reduce duplicate post-merge checks in release-please flow

[feddernico]

Summary

This PR simplifies the GitHub Actions workflow split for a protected-branch setup where all changes land through pull requests.

What changed

• Removed push to main from CodeQL so security analysis runs on:
  • pull requests to main
  • the scheduled weekly scan
• Simplified the release workflow so merged release PRs:
  • install dependencies
  • regenerate ink-app.html
  • create tags
  • publish the GitHub release
• Removed redundant post-merge validation from the release workflow:
  • npm run build
  • npm test
• Updated contributor and agent guidance to document the intended workflow responsibilities.

Why

Before this change:

• PR checks already validated build, QUnit, and Cypress before merge
• CodeQL ran on pull requests and again on main pushes
• the release workflow reran build/tests after the release PR merged

That made release finalization slower and duplicated checks that were already enforced by protected-branch PR gating.

New workflow split

• pr-checks.yml: primary validation gate before merge
• codeql.yml: PR + scheduled security scanning
• release.yml: release orchestration and artifact assembly only

Expected impact

• Faster release finalization
• Less duplicated CI work
• Clearer separation between validation and publishing workflows

Files changed

• codeql.yml
• release.yml
• CONTRIBUTING.md
• copilot-instructions.md

Notes

This assumes main remains protected and all changes continue to land through pull requests.