feat: add update-major-version-tag reusable composite action

[Mrtenz]

The publish-release.yml workflow updated the major version shorthand tag (e.g., v1) via a shell script that used git push. This approach doesn't support tag protection rules, since those require pushes to be authenticated as a specific account or app to bypass the tag protections.

This PR replaces the shell script with a reusable composite action at .github/actions/update-major-version-tag that calls the GitHub API directly, accepting an explicit github-token input. Using a Token Exchange Service token here enables tag protection rules that restrict which actors can create or update tags. The action can also be used by other repos via uses: MetaMask/github-tools/.github/actions/update-major-version-tag.

---

Note

Medium Risk
Changes release automation, token sourcing, and how protected tags are updated; misconfiguration could block releases or fail to move major version tags.

Overview
Release publishing no longer updates the major shorthand tag (e.g. v1) via a bash script that deleted and re-pushed tags with git. That flow is replaced by a reusable composite action at .github/actions/update-major-version-tag that moves the tag with the GitHub REST API (PATCH or POST on refs), driven by an explicit github-token and the published release-version.

The publish-release path is aligned with tag protection: the job uses the action-publish environment, default contents: read plus id-token: write, a get-token step (token exchange with contents: write), and passes that token to MetaMask/action-publish-release and the new tag action. main.yml’s publish job drops broad contents: write in favor of the same read + id-token pattern for the reusable workflow.

^{Reviewed by Cursor Bugbot for commit 52936db. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0d74f23. Configure here.}