ci: run the staging version job on staging only

[bryanfawcett]

Adds the coordinator's staging-version guard: the version job (which calls the reusable staging release) now runs only when github.ref == 'refs/heads/staging'. A workflow_dispatch from any other branch now skips the job instead of tagging a patch release from a non-staging ref. The upstream reusable workflow in nyuchi/.github is getting its own guard separately, so this is a second layer.

One line, identical across the sweep repos. This repo was already released to main today; the guard goes out with its next release.

• actionlint: clean

🤖 Generated with Claude Code

https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq

[bryanfawcett]

Merge gate record

• Scope: complete. One line, the identical coordinator guard if: github.ref == 'refs/heads/staging' directly under the version job id.
• actionlint: clean (local, and the lint / actionlint check).
• Code review: /code-review ran on this PR and found nothing. A reviewer note asked about pull_request triggers, where github.ref would be refs/pull/N/merge. This workflow triggers only on push: [staging] and workflow_dispatch, so the note doesn't apply. No findings to fix, so a re-review is clean.
• Runtime verification: no runtime surface (a CI workflow condition). The guard first takes effect on the next push to staging, and this merge is that push.
• CI: required checks green.