feat: maintain a moving minor tag for action pinning

[titouanmathis]

Why

Consumers want to pin the action to a minor series and get patches automatically, e.g. @0.8.x. GitHub uses: refs don't support wildcards, so @0.8.x is invalid — the established pattern (à la actions/checkout@v4) is a moving tag re-pointed to each release.

What

• publish.yml: after a stable release, force-move a MAJOR.MINOR tag (e.g. 0.8) to the release commit and push it. Consumers can then pin @0.8 and receive 0.8.x fixes automatically.
• README: pin examples switched to @0.8 with a "Pinning the ref" note covering moving tag vs exact patch vs SHA vs @main.

Design notes

• No moving @0 tag. Per the project's 0.x rule, a minor bump marks a breaking change, so the minor series is the compatibility boundary. A moving major tag would cross 0.8 → 0.9 breaking changes and mislead consumers.
• No trigger loop. The moving tag has a single dot (0.8) and cannot match the *.*.* publish trigger, so pushing it never re-runs the workflow.
• Prereleases skipped (if: env.IS_PRERELEASE == 'false'), so an rc/beta tag never advances the stable minor pointer.
• Uses the checkout's persisted GITHUB_TOKEN (job already has contents: write); a lightweight force tag needs no git identity.

The 0.8 tag pointing at 0.8.3 will be created immediately after merge so @0.8 works today; the workflow keeps it current from the next release on.

🤖 Generated with Claude Code

[github-actions]

Code Review

Risk: Low — I did not find blocking defects in this MR; it is safe to merge as-is.

This MR updates the release workflow to force-move a MAJOR.MINOR tag after stable releases and rewrites the README pinning guidance around the new moving-tag pattern. I did not find concrete defects in the implementation shown here. The changelog also records the new action-pinning behavior for the next release.

Notes:

• The intent says the existing 0.8 tag will be created immediately after merge, but this diff only updates the workflow and docs; it does not include a one-off tag creation step for the current release.

---

Review usage: 16,465 in (11,264 cached) / 1,240 out tokens — $0.0344 (cloudflare-ai-gateway/gpt-5.4, thinking: medium)

Reviewed by @weareikko/code-review v0.8.3 for commit 007ff5a.