Release workflow: publish to RubyGems.org from GitHub Actions

[PetrHeinz]

Adds the Release workflow the Ruby gems use (logtail-ruby, logtail-ruby-rack, logtail-ruby-rails), so releasing the plugin no longer means a manual gem push: Actions → Release → Run workflow from main, pick patch or minor. It runs the tests, bumps the version, builds the gem, commits and tags vX.Y.Z, pushes the gem with trusted publishing (OIDC, no API key) and creates the GitHub release. retry finishes a release that failed halfway; dry runs build and verify the publisher without pushing. release.yml is byte-identical to the one in the other three repos.

• The version now lives in one place, lib/fluent/plugin/logtail/version.rb, which the workflow bumps and both the gemspec and the plugin read. Until now the gemspec said 0.2.1 while the plugin sent User-Agent: Logtail Fluentd/0.1.1.
• The spec expects the User-Agent to carry the version of the gem the bundle loaded, so a bump needs no spec change.

The first commit only changes the spec and is red on CI (Logtail Fluentd/0.1.1 vs the expected 0.2.1); the following commits make it green. The push touching release.yml ran a branch dry run: tests, bump 0.2.1 → 0.2.2 in place, gem build of 0.2.2; Publish is skipped outside main.

Before merging, on GitHub and rubygems.org:

• Create the rubygems environment with deployment branches limited to main and no reviewers, as in the other repos. Without it, the first job on main would create the environment unprotected.
• Add the trusted publisher on rubygems.org: fluent-plugin-logtail → Trusted publishers → GitHub Actions, owner logtail, repository fluentd-plugin-logtail, workflow release.yml, environment rubygems. The push that merges this PR then performs the OIDC token exchange as a dry run.

main is not protected in this repo, so the version commit pushes without the github-actions bypass the workflow header mentions; that sentence applies once main gets the same protection as the other repos.

🤖 Generated with Claude Code