ci: add tagged release workflow

[backnotprop]

Summary

• add a tag-gated, dry-runnable release workflow for the Node bundle, multi-architecture GHCR image, and three public adapters
• generate verified SPDX SBOMs, checksums, GitHub attestations, and a GitHub prerelease
• publish npm provenance automatically once the source repository is public; use the scoped npm token without provenance while it remains private, per npm policy
• reuse the canonical full iteration gate without dependency caches on the release path

Verification

• pnpm verify:iteration
• local dry-run package, adapter, SBOM, OCI, and release-asset assembly
• shell syntax, YAML parsing, release metadata checks, zizmor, and git diff --check

The repository remains private and the root package remains unpublished, as intended.