fix(release): harden package publication

[calmcacil]

Summary

• replace overlapping CI, tag, and release workflows with the portfolio-standard flow
• preserve the BigWigs multi-client ZIP and release.json contract
• add immutable action pins, checksums, package compatibility gates, and rerun-safe publication
• document App setup, first-release verification, recovery, and rollback

Validation

• bash scripts/check.sh
• tagged BigWigs v2.5.1 snapshot for v3.1.1
• six-client TOC and runtime-module archive verification
• release.json schema comparison with v3.1.0
• publication retry simulation without asset replacement

Release intent

Patch release: this fixes release provenance, package verification, and recovery behavior without changing addon runtime compatibility.