release.yml: one workflow, three assets, two images

[qcentic-dev]

Part of #23. Spec: ADR 0016 — The 0.1.0 shape, clauses D28, D29, D30, D31, D32, D34.

Phase 3 — CI and release
Blocked by: #33, #34, #37, #43
Blocks: #51, #52

What

Replaces harness-release.yml + images-release.yml + dockerhub-description.yml. On push: tags: v* plus workflow_dispatch. Measured target: a release lands in under 6 minutes (today's equivalent Images Edge run — both images, both arches, both registries — took 3m16s; tarball legs are ~0.7–0.8 min each).

Jobs: resolve → tarball (matrix ×2, native runners) → panel / core (via the reusable container-image.yml, push: true) → github-release → descriptions (T23).

Two things that must not be "fixed" later and belong in the workflow as comments:

• GHCR is pushed first and must complete, even though Docker Hub is the "primary" registry. Primary means the canonical place a user is told to pull from, not publish order. GHCR authenticates with the workflow's own github.token and therefore cannot fail on credentials, which is exactly why it goes first.
• Present-but-broken Docker Hub credentials publish GHCR completely — per-arch tags and manifest — then fail the run at the very end. Failing early would strand GHCR with per-arch tags and no manifest.

Done when

• A tag publishes exactly three assets: actana-core-<version>-linux-x64.tar.gz, actana-core-<version>-linux-arm64.tar.gz, SHA256SUMS
• Image tags: <version> and latest from a version tag (non-prerelease only); no 0/0.1 ladder — under semver a 0.x minor bump is the breaking change, so a moving :0 tag is a lie by construction
• v1.0.0-rc.1 publishes 1.0.0-rc.1 and does not move :latest
• One Docker Hub PAT serves both docker login and the description API; DOCKERHUB_DESCRIPTION_USERNAME/_TOKEN are deleted. (An OAT can push images but returns "Cannot log into an organization account" on POST /v2/users/login, so it would mean paying for Team/Business and still provisioning a PAT)
• A missing Docker Hub credential fails on actana/control and still skips on forks — a release that never reached the primary registry must not report success
• PAT rotation is documented in docs/contribute/repo-setup.md: the token belongs to a person and dies with that account
• install.sh is not an asset and stays on raw.githubusercontent.com/actana/control/main/install.sh
• The installer-contract rule from ADR 0016 D29 is quoted verbatim in the workflow header

---

_{Decisions are locked in ADR 0016. If this ticket needs one changed, amend the ADR in the same PR — do not decide it in a comment.}