feat: add automated release workflow with tag validation and release-environment gate

[LaGodxy]

Summary

Adds .github/workflows/release.yml to publish a GitHub Release automatically when a vMAJOR.MINOR.PATCH tag is pushed. Uses softprops/action-gh-release@v2 with auto-generated release notes. Conservative defaults: read-only version validation against pyproject.toml, manual approval via the release GitHub Environment, and least-privilege permissions.

Changes

• Tag-push trigger matching v[0-9]+.[0-9]+.[0-9]+ plus a manual workflow_dispatch input for ad-hoc releases.
• Tag-format validation (^v[0-9]+\.[0-9]+\.[0-9]+$) before any downstream step runs.
• The inputs.tag value is passed through env: (not direct shell interpolation) to guard against script-injection.
• Read-only step that fails fast if pyproject.toml's version doesn't match the tag — the maintainer bumps locally first, commits, pushes the version bump to main, THEN tags the release. This avoids drift between tags and main.
• Single job running in the release GitHub Environment (manual approval gate) with permissions: contents: write scoped to that job only.

Testing

• python -c "import yaml; yaml.safe_load(open('.github/workflows/release.yml'))" parses cleanly.
• Manual action-reference audit: actions/checkout@v6, actions/setup-python@v6, softprops/action-gh-release@v2.

Closes #73