fix: publish runtime assets on GitHub releases

[f0rr0]

Summary

• package generated portable WASIX and target AOT bundles as public GitHub release assets during publish
• add xtask release package-assets and xtask assets download --release <tag> for no-gh release asset installs
• document the public release asset path for maintainers and contributors
• refresh the asset input fingerprint for the release tooling change

Verification

• cargo run -p xtask -- release package-assets
• cargo run -p xtask -- assets download --release 0.4.1 --target-triple aarch64-apple-darwin
• scripts/validate.sh workflows
• cargo check -p xtask --locked
• cargo run -p xtask -- assets verify-committed
• pre-push hooks: git diff --check, cargo fmt, asset input fingerprint, example lockfiles, cargo check

Release asset backfill

• uploaded generated public assets to 0.4.1 and 0.4.0
• uploaded legacy committed asset bundles to 0.3.0, 0.2.0, and 0.1.0