ci: release codescan as the mono-repo it now is

[fredbi]

Adding cmd/genspec-tui made this a multi-module repository, but the release workflows still called the single-module shared workflows. go-test.yml had already been switched to go-test-monorepo.yml; the release pair had not.

bump-release.yml now calls bump-release-monorepo.yml. Beyond tagging every module rather than only the root, that workflow rewrites each submodule's require on the root module to the version being cut, opens a pull request with those go.mod changes, and waits for it to merge before it tags — so a submodule published from this repo names a real release of the library instead of whatever stale version it happened to carry. The job therefore needs pull-requests:write in addition to contents:write.

The switch is not a one-way door: the mono-repo workflow opens with a module-detection job and delegates to the single-module path when it finds only one module.

tag-release.yml passes is-monorepo, which makes the release job generate release notes per module instead of one changelog for the whole repository.

Both stay on the ci-workflows v0.4.2 pin already used by go-test.yml. Follows go-openapi/core, which is on the same pin with the same shape.

Note the mono-repo release will also rewrite the require in docs/examples and fixtures, which pin v0.0.0 behind a replace today. That is expected, and harmless: both are internal modules that nothing outside this repository imports.

Change type

Please select: 🆕 New feature or enhancement|🔧 Bug fix'|📃 Documentation update

Short description

Fixes

Full description

Checklist

• I have signed all my commits with my name and email (see DCO. This does not require a PGP-signed commit
• I have rebased and squashed my work, so only one commit remains
• I have added tests to cover my changes.
• I have properly enriched go doc comments in code.
• I have properly documented any breaking change.