ci: skip the test suite on release-please Release PRs

[mogita]

Ticket

CHA-5511

Problem

release-please opens a Release PR that bumps the version and rewrites the changelog. Every source commit in it already passed this suite on the PR it came from, so the full run on the Release PR only delays the release.

Solution

if: >-
  ${{ !(github.actor == 'github-actions[bot]'
  && github.event.pull_request.user.login == 'github-actions[bot]'
  && github.event.pull_request.head.repo.full_name == github.repository
  && startsWith(github.head_ref, 'release-please--')) }}

Guarded here: build-and-test

All four clauses must hold, and each one fails open, so anything short of a Release PR that release-please both opened and last pushed runs the suite. The branch name alone would not do: any PR, a fork's included, could call its branch release-please--x and skip every required check, which branch protection counts as satisfied. github.actor is the pusher rather than the PR author, so a human commit pushed onto the Release PR is tested like any other.

The pre-tag gate is unaffected: release.yml triggers on push, where there is no pull request, so the suite still runs before a tag lands.

Known trade

release-please rewrites the version file, and those bytes appear on no other PR. After this change nothing checks them until release.yml's pre-tag gate, which runs after the merge, so a broken substitution surfaces as a stuck release needing the manual recovery in the release README rather than as a red check on a PR you close. Accepted: the substitution is the only thing in a Release PR that has not already been tested, and splitting a cheap lint leg out of the combined job in five repos costs more than the failure does.

How to verify

1. This PR is not a Release PR, so everything below should run as usual.
2. On the next Release PR, the guarded jobs should report Skipped with no required check left pending.

[mogita]

The guard keys on the branch name rather than on who authored the head commit, so a hand-pushed commit onto a Release PR is never tested either. Release PR #81 modifies src/Client.cs and src/stream-feed-net.csproj; if someone pushes a correction onto release-please--branches--master (fixing a changelog entry, correcting a version, resolving a conflict), github.head_ref is unchanged, build-and-test still skips, and that human commit reaches master having run neither dotnet format --verify-no-changes, the build-warning check, nor the tests. It is then caught, if at all, only by release.yml's pre-tag gate, as a stuck release.

[mogita]

Fixed. github.actor is the pusher rather than the PR author, so it is now the first clause of the guard:

if: >-
  ${{ !(github.actor == 'github-actions[bot]'
  && github.event.pull_request.user.login == 'github-actions[bot]'
  && github.event.pull_request.head.repo.full_name == github.repository
  && startsWith(github.head_ref, 'release-please--')) }}

A correction pushed by hand onto release-please--branches--master makes github.actor that person, the guard fails open, and build-and-test runs. Only release-please's own pushes skip.