Keep active CCS workflows on self-hosted runners, gate self-hosted PR execution to trusted authors, and scope privileged release credentials to the exact git operations that need them.
- Remove dev branch from semantic-release (main only)
- Add dev-release.yml: simple X.Y.Z-dev.N bump workflow
- Update sync workflow: handle merge conflicts for version files
- Update release.yml: trigger only on main branch
Dev versions now stay at {stable}-dev.N until merged to main.
PR merge commit type (feat/fix) determines actual version bump.