ci: validate release packaging without publishing - #118

Closes #79

What this changes

The Release workflow now runs the exact three-platform packaging path for relevant pull requests and manual dry runs. Only a v* tag push can enable the publish job.

Each package is verified before upload:

• the macOS zip must be readable and contain the app host, CLI, and MCP binaries
• Linux tarballs must contain the CLI, host, MCP adapter, installer, and agent runtime resource
• non-tag runs use a numeric 0.0.<run> version that is valid in the generated macOS plist

Safety properties

• contents: write remains isolated to the publish job, which independently requires a push event, a refs/tags/v* ref, and publish=true
• pull requests and manual runs always produce publish=false
• manual runs reject dry_run=false and direct maintainers to publish through a version tag
• PR path filters cover the release workflow, repository release scripts, both build scripts, the Linux installer, Dockerfile, and Swift package manifest

Verification

• actionlint -color
• pnpm test (44/44 protocol tests and MCP integration)
• pnpm test:runtime
• pnpm --filter @headless/web lint
• pnpm --filter @headless/web build
• HEADLESS_VERSION=0.0.79 ./apps/headless/build.sh
• pnpm test:e2e:mac (WebKit conformance and P2 flow)
• pnpm test:e2e:linux (Chromium conformance, P2 flow, and artifact checks)
• HEADLESS_LINUX_PLATFORM=linux/arm64 ./apps/headless/build-linux.sh
• exact macOS zip and Linux tarball content assertions from the workflow
• git diff --check