fix(ci): avoid protected branch push in plugin releases

[syzsunshine219]

Summary

• avoid pushing release commits directly to protected main from plugin publish workflows
• push version bump commits to release/ branches and create PRs instead
• skip npm publish when the requested version already exists, so partially completed releases can be rerun safely
• include package-lock.json in memos-local-plugin release metadata commits

Verification

• ruby YAML parse for both workflow files
• bash -n for updated publish/release shell blocks
• git diff --check