Publish versioned release assets from tags

[jagg-ix]

What changed

• added scripts/release-assets.sh to construct a release-ready source archive, machine-readable release manifest, and release-level SHA256SUMS
• added make release-assets with configurable ref, version, and output directory
• added a pull-request validation workflow that constructs and verifies release candidates without publishing
• added a tag-driven publication workflow that validates v<version> against lakefile.lean, builds the assets, and creates or updates the matching GitHub Release
• documented local construction, CI validation, tag publication, retry behavior, asset contents, and integrity rules in RELEASING.md

Why

The repository already had deterministic source-bundle packaging, but no automated path connected those files to GitHub Releases and no pre-merge check exercised that path. This change reuses the existing packager and adds release assembly, validation, and publication.

Release behavior

Pushing a tag such as v0.1.0 publishes:

• zil-lean-0.1.0.tar.gz
• zil-lean-0.1.0.release.tsv
• SHA256SUMS

Publication refuses malformed tags, tags that do not exactly match the version declared in lakefile.lean, and checkouts that do not resolve to the tagged commit. A manual workflow dispatch can retry publication only for an existing version tag.

Validation

The Validate release assets workflow passed on this PR. It verified:

• Bash syntax for the packaging and release scripts
• construction of all three release files
• successful sha256sum --check SHA256SUMS for the archive and manifest
• manifest version and source-commit metadata
• rejection of an explicit version that differs from lakefile.lean
• upload of the constructed release candidate as a seven-day workflow artifact

The release validation is dependency-light and does not require the Lean or Clojure toolchains because the published artifact is a committed source bundle.