## Summary
Cherry-pick of #2297 to `releases/v0.4`.

- Fix publish eligibility check in `cli.yml` to use `inputs.ref` (RC
tag) instead of `GITHUB_REF_NAME` (branch) for `workflow_call` triggers
- Add documentation for `workflow_call` ref inheritance behavior across
release workflows

---------

Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Co-authored-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>

…ponent-model#2297)

## Summary

- **Fix publish gating in `cli.yml`**: When called via `workflow_call`
from `cli-release.yml`, `GITHUB_REF_NAME` inherits the caller's ref
(`releases/v0.4`) instead of the RC tag (`cli/v0.4.0-rc.1`). The
`should_push_oci_image` check only matched `main` or `cli/v*`, so the
Publish and Attest job was skipped for releases dispatched from release
branches. Now uses `inputs.ref` when available.
- **Update `RELEASE_PROCESS.md`**: Replace stale "Branch to release
from" input reference with the "Use workflow from" branch selector,
matching the workflow change in open-component-model#2131.

## Root Cause

After open-component-model#2131 removed the explicit `branch` text input from
`cli-release.yml`, the operator must select the `releases/v*` branch in
the GitHub UI "Use workflow from" dropdown. This sets `GITHUB_REF_NAME =
"releases/v0.4"` for the entire call chain.

`cli.yml`'s branch-check (`should_push_oci_image`) tests
`GITHUB_REF_NAME` against:
1. Default branch (`main`) — no match
2. `cli/v*` tag pattern — no match

Result: Publish and Attest skipped → Conformance skipped.

The v0.3 release worked because the old workflow was dispatched from
`main` (the text input carried the branch separately), so
`GITHUB_REF_NAME = "main"` matched condition 1.

## Fix

Use `inputs.ref` (the RC tag, e.g. `cli/v0.4.0-rc.1`) when present, fall
back to `GITHUB_REF_NAME` for direct triggers. The RC tag matches the
`cli/v*` pattern, enabling publish.

| Trigger | `inputs.ref` | Effective ref | Publishes |
|---------|-------------|---------------|-----------|
| `workflow_call` from `cli-release.yml` | `cli/v0.4.0-rc.1` |
`cli/v0.4.0-rc.1` | Yes |
| Push to `main` | empty | `main` | Yes |
| Push tag `cli/v0.4.0` | empty | `cli/v0.4.0` | Yes |
| Push to `releases/v0.4` | empty | `releases/v0.4` | No (build-only) |
| Pull request | n/a | step skipped | No |

## Test plan

- [ ] Verify the v0.4 release workflow can be re-run successfully from
`releases/v0.4` after this change is cherry-picked
- [ ] Dry-run a CLI release from a release branch to confirm Publish and
Attest job is no longer skipped

---------

Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Co-authored-by: Gerald Morrison (SAP) <gerald.morrison@sap.com> aa48cc6