Add weekly auto-tag for CalVer releases

[wnstfy]

Summary

Tuesday 08:00 UTC cron tags `vYYYY.MM.DD` when commits exist since the last release, then dispatches `release.yml` to publish the signed artifacts.

Why this shape

`GITHUB_TOKEN`-driven tag pushes deliberately don't trigger other workflows (GitHub's anti-recursion rule), so a tag-push alone wouldn't fire `release.yml`. Two clean options:

1. PAT — push the tag with a personal access token (PAT pushes do trigger workflows).
2. `workflow_dispatch` chain — push tag with `GITHUB_TOKEN`, then explicitly `gh workflow run release.yml --ref `.

This PR uses option 2 to avoid introducing another long-lived secret. `release.yml` gains `workflow_dispatch` and an `if: startsWith(github.ref, 'refs/tags/v')` gate so a manual dispatch from `main` is a no-op rather than producing broken artifacts.

Behaviour

Condition	Result
Commits since last tag, today not yet used	Tag `vYYYY.MM.DD`, release published.
Commits since last tag, today already used	Tag `vYYYY.MM.DD.1` (or `.2`, ...).
No commits since last tag	Skip silently.
`workflow_dispatch` with `force=true`	Tag anyway.

Cadence sits after the Monday `weekly-audit` cron (06:00 UTC) and the Tuesday `scorecard` cron (07:20 UTC), so each weekly release reflects the latest CVE state and Scorecard run.

Test plan

• `actionlint` passes (clean locally with `rhysd/actionlint:1.7.7`).
• `scan`, `misconfig` informational checks pass.
• After merge, manually fire `weekly-release.yml` via `gh workflow run weekly-release.yml -f force=true` to validate the full chain end-to-end on a controlled tag (and immediately verify the signed release the same way as v2026.05.21).
• Confirm the next-Tuesday cron run is on the schedule.

[github-actions]

Trivy misconfiguration findings (HIGH + CRITICAL)

Findings below. Fix the issue or add an ignore entry to .trivyignore with a justification.

Report Summary

┌────────┬──────┬───────────────────┐
│ Target │ Type │ Misconfigurations │
├────────┼──────┼───────────────────┤
│   -    │  -   │         -         │
└────────┴──────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)