ci(release): publish tagged Linux and macOS builds

[xjdr-noumena]

Summary

• Add GitHub Actions CI for contract tests and package smoke on ubuntu-24.04, macos-14, and macos-15-intel.
• Add tag-driven release workflow for v*.. tags reachable from main.
• Build and smoke-test external release packages for linux-x64, darwin-arm64, and darwin-x64.
• Publish zip artifacts, sha256 files, manifests, and GitHub artifact attestations.
• Document the new release process and allow packageSmoke to validate external builds.

Validation

• ruby YAML parse for .github/workflows/ci.yml and .github/workflows/release.yml
• release-note extraction smoke against CHANGELOG.md
• bun build/packageSmoke.mjs --build-mode external --target bun-linux-x64 --out-dir /tmp/ncode-gha-package-smoke --no-run --no-native-probe --keep-output
• bun build/packageSmoke.mjs --build-mode external --target bun-linux-x64 --out-dir /tmp/ncode-gha-package-smoke-full --keep-output