v0.0.1

refactor(release-rmpc): build first, tag+publish only on success

Old order created+pushed the tag before any build ran, so a build failure
left an orphan tag pointing at a commit whose binaries couldn't be
produced. New order:

  resolve -> build (matrix x4, uploads artifacts) -> publish

Publish job runs only after every build succeeds. It downloads all four
archives, creates+pushes the tag, and creates the GitHub Release with
all assets in one step. dry_run mode skips publish entirely.

Other changes:
- New resolve job expands short-form commit_hash via git rev-parse and
  emits a single canonical SHA + version string consumed by both build
  and publish, so checkout no longer fails when given a 7-char SHA.
- commit_hash defaults to github.sha so dispatching --ref <branch>
  builds that branch's HEAD with no extra input.
- Tag input is validated up front in resolve, not deep in the matrix.