fix(build): resolve release-please draft race condition

[WilliamBerryiii]

Pull Request

Description

Resolves the root cause of PR #173 generating a bogus changelog that included all previous release-please PRs. The "draft": true config causes release-please to use lazy tag creation — the git tag isn't materialized until the draft release is published. Without the tag, subsequent release-please runs scan the entire commit history, producing bloated changelogs.

Mirrors the proven mitigation from microsoft/hve-core PR #560.

Type of Change

• 🐛 Bug fix (non-breaking change fixing an issue)
• ✨ New feature (non-breaking change adding functionality)
• 💥 Breaking change (fix or feature causing existing functionality to change)
• 📚 Documentation update
• 🏗️ Infrastructure change (Terraform/IaC)
• ♻️ Refactoring (no functional changes)

Component(s) Affected

• deploy/000-prerequisites - Azure subscription setup
• deploy/001-iac - Terraform infrastructure
• deploy/002-setup - OSMO control plane / Helm
• deploy/004-workflow - Training workflows
• src/training - Python training scripts
• docs/ - Documentation

Changes

• release-please-config.json: Move "draft": true from top level to package level (matches hve-core structure)
• .github/workflows/main.yml:
  • Remove job-level if guard that skipped release-please entirely on release commits
  • Add skip-github-pull-request input conditioned on release commits (prevents bogus PRs without skipping tag/release creation)
  • Add explicit git tag creation step after release-please runs (ensures the tag exists for subsequent runs)
  • Remove Harden Runner steps from release-please and publish-release jobs

Testing Performed

• Terraform plan reviewed (no unexpected changes)
• Terraform apply tested in dev environment
• Training scripts tested locally with Isaac Sim
• OSMO workflow submitted successfully
• Smoke tests passed (smoke_test_azure.py)

Documentation Impact

• No documentation changes needed
• Documentation updated in this PR
• Documentation issue filed

Checklist

• My code follows the project conventions
• Commit messages follow conventional commit format
• I have performed a self-review
• Documentation impact assessed above
• No new linting warnings introduced

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

• .github/workflows/main.yml