Pre release test

ci: harden the release workflow

Reading the gh manual found a real defect: --notes-file does not combine
with --generate-notes. The documented way to prepend a custom body is
--notes, so the release notes are passed inline; as written, the flashing
and wiring instructions would likely have been dropped.

Tags no longer reach a shell through ${{ }} interpolation, which was a
command-injection path. They travel via env, are resolved once in a
version job so build and publish cannot disagree, and are rejected unless
v-prefixed.

Four refusals, each guarding an otherwise silent failure:
  - building from failing tests
  - publishing an implausible image (UF2 magic and 512-byte-multiple size
    are checked, so a truncated file fails the build, not the board)
  - inventing a tag that was never pushed (--verify-tag)
  - leaving a half-populated release: create and upload are separate API
    calls, so the release is read back and every asset confirmedEOF