fix(ci): release through protected main

[abrichr]

Summary

• use the existing ADMIN_TOKEN release credential for checkout, semantic-release, and GitHub release publication so the generated version commit can cross protected main
• set major_on_zero = false so a patch from 0.1.1 becomes 0.1.2 rather than the incorrectly calculated 1.0.0
• add regression tests for both release invariants

Incident

Release run 29453039836 failed before publishing because GITHUB_TOKEN could not push the generated version commit. The same dry run also calculated 1.0.0. No v1.0.0 tag, GitHub release, or PyPI artifact was created.

Verification

• focused release/dependency tests pass on Python 3.10 and 3.12
• Ruff check and format pass
• workflow YAML parses
• the incorrect v1.0.0 ref is absent

Merging this fix should release the already-merged privacy security change as 0.1.2.