feat: add guarded release workflow

[kalvinnchau]

implementation

This adds a maintainer-owned release state machine around the existing build, signing, staging, and promotion scripts.

• just release-prepare X.Y.Z generates notes through just release-notes, prints them for explicit [y/N] approval, creates release/vX.Y.Z from current origin/main, synchronizes the app/CLI/plugin versions and Cargo lock entries, updates CHANGELOG.md, runs focused validation, creates one conventional release commit, pushes the branch, and opens the release PR.
• just release-publish X.Y.Z resolves the merged release PR's squash commit through GitHub, verifies that commit is reachable from origin/main, revalidates its committed version/changelog state, creates an annotated tag on that exact commit, and pushes only the tag ref.
• tag publication is resumable after local or remote push ambiguity when the existing annotated tag resolves to the verified merge commit; conflicting tags fail closed.

release invariants

• public versions must be canonical SemVer at or above 0.6.0-rc.1
• package.json, Tauri config, the Berd/berdctl/plugin Cargo manifests, and their Cargo lock entries move in lockstep
• an immutable tag must be annotated, main-reachable, source-bound, and match the committed changelog entry before GitHub creates or resumes a release
• GitHub release notes are derived from the committed changelog and checked for drift on recovery
• updater public-key configuration is supplied as a repository secret

failure and recovery behavior

• declining generated notes exits before creating a branch, commit, push, or PR
• failed preparation validation restores all tracked release files
• an existing release branch or PR is resumed only when its commit, metadata, and source boundary match the requested release
• a partially completed tag push can be retried without deleting a valid local tag
• release workflow recovery remains bound to the original tag and source commit

validation

• just check
• just release-validate
• 78 release-script tests, including approval rejection, minimum-version enforcement, preparation rollback, publish retry, annotated-tag verification, and changelog/manifest SemVer behavior