Make release process work with protected main branch

[bfirsh]

trafficstars

Currently the release depends on us being able to push directly to main, which is error-prone. Let's figure out something better.

[bfirsh]

It would also be nice to make the release process more automatic. Maybe it could be done by an automated system entirely, but even the local process is somewhat manual and error-prone. For example,:

• I have to make sure my local branch is in sync with upstream main before running the command, otherwise it breaks in a way that is hard to recover from.
• make release should be idempotent