ci: add v2 maintenance release line

Mirror the v1 maintenance pattern from ai-tool-set: cut the v2 branch as
a separate release line for the previous major once v3 becomes latest.

- ci.yml: add a release-v2 job (gated to the v2 branch, target-branch v2,
  default config/manifest, manually merged) and trigger CI on pushes to v2
- release.yml: publish under the legacy dist-tag and force-push the floating
  v2.x tag, so v2 releases never move latest off the current major

Author: zirkelc

.github/workflows/ci.yml

@@ -5,6 +5,7 @@ on:
     branches:
       - main
       - next
+      - v2
   pull_request:
 
 concurrency:
@@ -105,3 +106,23 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
         run: gh pr merge --squash --auto -R "${{ github.repository }}" "${{ fromJSON(steps.release.outputs.pr).number }}"
+
+  # Stable maintenance line for the previous major, cut from the `v2` branch.
+  # Uses the default release-please-config.json / .release-please-manifest.json,
+  # which on this branch track the 2.x line. The release PR is reviewed and
+  # merged manually; on merge it tags + creates a GitHub Release, which
+  # release.yml (on this branch) publishes under the `legacy` dist-tag so it
+  # stays off `latest`.
+  release-v2:
+    name: Release v2
+    runs-on: ubuntu-latest
+    needs: [lint, test]
+    if: github.ref == 'refs/heads/v2'
+    steps:
+      # https://github.com/googleapis/release-please-action
+      - name: Release Please
+        uses: googleapis/release-please-action@v5
+        with:
+          # https://github.com/googleapis/release-please-action?tab=readme-ov-file#github-credentials
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          target-branch: v2

.github/workflows/release.yml

@@ -12,6 +12,7 @@ on:
 
 permissions:
   id-token: write # needed for npm publish with provenance
+  contents: write # needed to force-push the floating major version tag
 
 jobs:
   release:
@@ -30,14 +31,20 @@ jobs:
           cache: 'pnpm'
       - run: pnpm install
       - run: pnpm build
-      # A prerelease release (cut from the `next` branch) is flagged
-      # `prerelease: true` by release-please, so publish it under the `next`
-      # dist-tag to keep `latest` pointing at the stable line. A normal release
-      # publishes to `latest`. workflow_dispatch has no release payload, so the
-      # prerelease flag is falsy and it publishes to `latest`.
-      - name: Publish to npm (latest)
-        if: ${{ !github.event.release.prerelease }}
-        run: pnpm publish --provenance --no-git-checks
-      - name: Publish to npm (next)
-        if: ${{ github.event.release.prerelease }}
-        run: pnpm publish --provenance --no-git-checks --tag next
+      # This is the v2 maintenance line. It always publishes under the `legacy`
+      # dist-tag so it never moves `latest` off the current major.
+      # (npm rejects `v2` as a dist-tag since it parses as a SemVer range.)
+      - name: Publish to npm (legacy)
+        run: pnpm publish --provenance --no-git-checks --tag legacy
+      # Move the floating v2.x tag onto this release commit so version-pinned
+      # links like /tree/v2.x always resolve to the newest v2 release. Pushed
+      # with the default GITHUB_TOKEN, whose pushes do not re-trigger workflows.
+      # Gated to `release` since workflow_dispatch has no tag payload.
+      - name: Update major version tag
+        if: ${{ github.event_name == 'release' }}
+        env:
+          TAG: ${{ github.event.release.tag_name }} # e.g. v2.2.0
+        run: |
+          major="${TAG%%.*}"               # v2.2.0 -> v2
+          git tag -f "${major}.x"          # tag the checked-out release commit -> v2.x
+          git push -f origin "${major}.x"