ci: add tagged release workflow

[owainlewis]

Closes #34.

Summary

• Add a tag-triggered GitHub Actions release workflow for v*.*.* tags.
• Build the macOS release binary and package it as a platform-named .tar.gz.
• Generate a SHA-256 checksum and publish both assets to a GitHub Release.
• Fail instead of overwriting assets if the release already exists.

Acceptance Criteria

• Pushing vX.Y.Z starts the release workflow.
• The workflow builds the release binary on macOS.
• The GitHub Release contains a macOS binary archive.
• The GitHub Release contains a checksum file.
• A failed build does not publish a misleading release artifact.

Verification

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release.yml")' passed locally.
• cargo test passed locally.
• cargo build --release passed locally.
• git diff --check passed locally.
• A temporary test tag will be pushed after merge to verify the real tag release path.

Review

• Subagent review found one important issue with gh release upload --clobber on existing releases.
• Fixed by failing closed when the release already exists instead of overwriting assets.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b1ba870167

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Verify the pushed tag before creating releases

If the matching tag is deleted or otherwise missing by the time this step runs, gh release create will not fail closed: the GitHub CLI manual says a missing tag is automatically created from the latest default-branch state unless --verify-tag is used. In that race, this tag-triggered workflow can publish artifacts built from one commit while recreating the release tag on another commit, so add --verify-tag here to abort instead.

Useful? React with 👍 / 👎.