fix(release): publish complete cross-platform assets

[zoeyrose]

Summary

• hand semantic-release tags to cross-platform packaging through a trusted workflow_run
• publish only after both Linux and Windows packages succeed
• support exact-tag repair of the empty v1.0.0 release while refusing asset replacement
• document the atomic release contract

Validation

• actionlint .github/workflows/*.yml
• shellcheck tools/*.sh
• Rust format, Clippy, unit/integration/doc tests, architecture/provenance checks
• Linux package workflow already passed independently in PR feat(client): establish clean-room foundations #43; Windows package execution is gated by this PR's workflow contract and post-merge repair run
• git diff --check

Review notes

Deep review finding R8 records the GitHub-token event-chain failure and the fail-closed repair. The package resolver accepts only semantic version tags reachable from protected main; existing non-empty releases are immutable.