ci: publish to pub.dev on tag push, add RELEASING.md

[MichaelGHSeg]

Summary

Makes publish.yml publishable through pub.dev automated publishing, and adds a RELEASING.md describing the process as it actually runs. Supersedes #206, whose doc predates the CI publish workflow (#210).

publish.yml

• Triggers on tag push instead of release: published. pub.dev automated publishing accepts only tag pushes and workflow_dispatch; a release event's OIDC token is rejected. Tag patterns: segment_analytics-v* and segment_analytics_plugin_*-v*.
• The tag selects the package. Previously a release event always published packages/core, whatever the tag said. <pubspec name>-v<version> now maps to its package directory.
• New meta job (.github/scripts/check-release-metadata.sh) runs before tests and before the production approval. It fails the run if:
  • the tag doesn't equal <pubspec name>-v<pubspec version>
  • the newest CHANGELOG.md section doesn't match the pubspec version
  • core's lib/version.dart doesn't match (it is sent as context.library.version)
  • the commit isn't on main
  • the workflow_dispatch package input isn't core or plugins/plugin_<name> (it reaches working-directory)
• Plugin publishes no longer fail at the test step. Only packages/core has a test/ directory; flutter test errors without one. Same fix Harden CI: Artifactory OIDC, pinned Flutter SDK, pub.dev Trusted Publishing #210 made in ci.yml.

workflow_dispatch stays as a manual re-run path.

RELEASING.md

Release steps (release PR → dry run → tag → approve → verify), core-before-plugins ordering, the plugin constraint widening a core major requires, tag format, the one-time pub.dev and GitHub environment setup, the Flutter version bump checklist, and a local dart pub publish break-glass.

Testing

check-release-metadata.sh run locally against main:

Case	Result
segment_analytics-v1.1.13 (push)	pass, package=core
segment_analytics_plugin_idfa-v1.0.3 (push)	pass, package=plugins/plugin_idfa
segment_analytics_plugin_advertising_id-v1.0.0 (push)	pass
plugins/plugin_firebase (dispatch)	pass
segment_analytics-v9.9.9 (version mismatch)	fail
evil-v1.0.0, segment_analytics_plugin_..-v1.0.0	fail
PACKAGE=../x (dispatch)	fail
GITHUB_SHA not on main	fail

The workflow itself has not run in Actions. publish.yml has no run history at all, so the first real tag push is also the first test of the OIDC exchange with pub.dev. RELEASING.md covers the local-publish fallback.

Setup status

• pub.dev automated publishing configured on all seven packages (repo, <package>-v{{version}} pattern, push + workflow_dispatch, environment production)
• production environment with required reviewers
• production deployment branches and tags limited to main plus the two tag patterns (currently unrestricted; the meta job's on-main check covers the commit, but not which ref may request the environment)