ci: redesign release publishing workflows

[CaseyLabs]

Context

• Current release automation mixes mutable prereleases with stable releases, making tag and asset policy hard to verify.
• Prereleases should move with master; stable releases should be manual, protected, and immutable.
• Release targets, checksums, notes, uploads, and attestations were duplicated across workflow steps.
• Local CI needed one documented path for workflow lint, YAML lint, Go checks, JS lint, and act dry runs.
• This branch is rebased on Monaco editor #607 and preserves the Monaco editor work.

Changes

• Splits release automation into CI, Prerelease, and Stable Release workflows.
• Publishes rolling prereleases automatically from master to the mutable prerelease tag.
• Publishes stable releases manually, draft-first, with semver tag/release reuse checks.
• Runs Go tests on PRs, but release cross-compiles only after merge to master.
• Centralizes release asset metadata in .github/scripts/release-assets.sh.
• Adds helper scripts for release builds, asset assembly, checksums, notes, and provenance text.
• Tidies shared Go actions and Makefile targets, including local CI, JS lint, and fmtcheck.
• Excludes vendored Monaco files from JSHint while preserving the editor implementation.
• Updates release docs and keeps PLAN.md local-only.

Validation

• make js-lint
• make ci-local

Review Notes

• Draft because this changes release policy and local CI behavior.
• Focus review on tag immutability, asset names, permissions, and prerelease/stable behavior.
• Rebased after Monaco editor #607, so the PR no longer removes Monaco editor files.

[Volte6]

Looks fine - I only checked the Go/Makefile changes, I'll defer to you on the rest.