ci: Trigger release workflow on push events only

Pushing a new tag fires both create and push events, so the workflow
ran twice for the same commit. Subscribe to push only and gate the
upload and release steps on the tag ref. Branch pushes still run the
builds as a smoke test and tag pushes still publish the draft release.

Author: saravan2

.github/workflows/release.yaml

@@ -1,5 +1,5 @@
 name: Cloud Hypervisor edk2 release
-on: [create, push]
+on: push
 
 jobs:
   build-x64:
@@ -29,7 +29,7 @@ jobs:
           make -C BaseTools
           OvmfPkg/build.sh -p OvmfPkg/CloudHv/CloudHvX64.dsc -a X64 -b RELEASE
       - name: Upload x86-64 artifact
-        if: github.event_name == 'create' && github.event.ref_type == 'tag'
+        if: startsWith(github.ref, 'refs/tags/')
         uses: actions/upload-artifact@v4
         with:
           name: cloudhv-x64
@@ -55,15 +55,15 @@ jobs:
           build -p ArmVirtPkg/ArmVirtCloudHv.dsc -a AARCH64 -t GCC -b RELEASE \
             --pcd gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy=0xC000000000007FD1
       - name: Upload AArch64 artifact
-        if: github.event_name == 'create' && github.event.ref_type == 'tag'
+        if: startsWith(github.ref, 'refs/tags/')
         uses: actions/upload-artifact@v4
         with:
           name: cloudhv-aarch64
           path: Build/ArmVirtCloudHv-AARCH64/RELEASE_GCC/FV/CLOUDHV_EFI.fd
 
   release:
     name: Release
-    if: github.event_name == 'create' && github.event.ref_type == 'tag'
+    if: startsWith(github.ref, 'refs/tags/')
     needs: [build-x64, build-aarch64]
     runs-on: ubuntu-latest
     permissions: