chore: fix release.sh so release PRs pass CI, add publish-workflow.sh

[rohan-hotdata]

Unblocks releasing this repo. No package code changes.

1. Release PRs could not pass CI

release.sh prepare bumped pyproject.toml and CHANGELOG.md but never relocked. uv.lock records this project's own version (uv.lock:265), and ci.yml installs with uv sync --locked — so the release PR the script opens fails CI before it can be reviewed.

Reproduced by bumping a scratch copy to 0.3.0:

$ uv lock --locked
Resolved 67 packages in 853ms
The lockfile at `uv.lock` needs to be updated, but `--locked` was provided.

prepare now runs uv lock and commits uv.lock alongside, and calls need uv up front rather than failing midway through a version bump.

2. default_branch() fallbacks were dead code

git symbolic-ref --quiet "refs/remotes/${remote}/HEAD" 2>/dev/null | sed "s|...|" \
  || { git branch -r | sed -n "..." | head -1; } \
  || echo main

sed always exits 0, so neither || branch can ever run. Against a remote with no origin/HEAD this returns the empty string, and the caller then runs git fetch origin "" / git checkout "" and fails with an unrelated-looking error.

Verified before and after in a scratch repo with a remote that has no refs:

OLD RESULT: []
NEW RESULT: [main]

3. scripts/publish-workflow.sh was missing

It is the generator that emits publish.yml, and is byte-identical in hotdata-ibis, hotdata-dlt-destination and the framework repo. Confirmed it regenerates the checked-in workflow exactly:

$ ./scripts/publish-workflow.sh hotdata-langchain | diff - .github/workflows/publish.yml
$

Provenance

Both script fixes are taken from hotdata-dlt-destination, which shares this repo's --locked CI, so they are known-correct in this configuration. hotdata-ibis and the framework repo still carry both bugs — the framework's uv lock variant additionally does [[ -f uv.lock ]] && git add uv.lock, which aborts under set -euo pipefail when the lock file is absent, so it is deliberately not the template used here. need uv is the one line taken from ibis.

No CHANGELOG entry: nothing user-facing changed, and this keeps the PR conflict-free with #44's changelog edits.

[claude]

super nit: prepare now hard-requires uv, but RELEASING.md "One-time setup" only lists gh. Worth adding a line there so someone hitting error: uv is required knows it's expected. (not blocking)

[claude]

super nit: this makes the generator a second source of truth for .github/workflows/publish.yml with nothing keeping the two in sync — a hand-edit to the workflow (e.g. bumping a pinned action SHA) would be silently reverted the next time someone regenerates. A one-line CI check (./scripts/publish-workflow.sh <pkg> | diff - .github/workflows/publish.yml) would catch drift. (not blocking)

[rohan-hotdata]

Both are fair. Took the first, declined the second — reasoning below.

1. uv prerequisite in RELEASING.md — fixed in ea14c76. A real gap, and one I introduced by adding need uv, so it belongs in this PR. Worth knowing the siblings share the omission: neither hotdata-dlt-destination nor hotdata-ibis mentions uv in RELEASING.md despite one running uv lock and the other calling need uv. So this line is a small, additive divergence from them rather than a copy — the right direction, and worth backporting there separately.

2. Drift check between the generator and publish.yml — not adding it here. The concern is real, but no sibling has such a check (grep -rl publish-workflow .github/ is empty in dlt-destination, ibis and the framework repo), and this PR exists specifically to bring this repo onto the shared pattern. A CI job unique to this repo would work against that. It is also an org-wide problem rather than a langchain one — the generator is byte-identical in all four repos, so drift there is equally possible everywhere and is best fixed once, in the generator convention, not four times independently. Filing it as a cross-repo task instead.

For the record on consistency, since it is the point of the PR: scripts/release.sh here now differs from hotdata-dlt-destinations by exactly two additive lines — need uv (verbatim from hotdata-ibis release.sh:106) and the comment above uv lock. scripts/publish-workflow.sh is byte-identical to both siblings.