ci: stop the duplicate GoReleaser run on release

Cutting a release produced a spurious failed workflow run. The Cut
Release job pushes the tag with RELEASE_GITHUB_TOKEN (a PAT), and
PAT-pushed tags DO trigger workflows — contrary to the job's comment
that assumed GITHUB_TOKEN semantics. So the tag push fired the Release
workflow's tag-push GoReleaser, which raced the Cut Release job's own
GoReleaser and failed uploading duplicate release assets (422
already_exists).

Cut Release already owns GoReleaser (binaries + Homebrew cask) and
dispatches the Release workflow for the OIDC npm publish. So make the
Release workflow npm-only and workflow_dispatch-only: drop its tag-push
trigger and its now-redundant GoReleaser job. This removes the racing
run entirely while leaving the proven publish path unchanged.

Also correct the stale comment in cut-release.yml about tag-push
workflow triggering.