ci: add secure tagged release workflow

[cbangera2]

What changed

• adds a release workflow triggered by version tags such as v2.1
• verifies the tag exactly matches the version in manifest.json
• runs syntax checks and the full test suite before release
• creates and verifies a minimal extension ZIP plus SHA-256 checksum
• generates a GitHub artifact provenance attestation
• publishes the ZIP and checksum as a GitHub Release with generated notes

Security

• PR validation uses read-only repository permissions
• release and attestation write permissions exist only in the tag-only publish job
• all official GitHub actions are pinned to immutable commit SHAs
• checkout credentials are not persisted
• tag names are validated before being used in artifact names
• no long-lived publishing credentials or repository secrets are required

Validation

• workflow YAML parsed locally
• node --check passed for all extension scripts
• node --test passed (6 tests)
• v2.1 was verified against manifest version 2.1
• the release archive was created and passed unzip -t

After this PR merges, pushing tag v2.1 will publish the v2.1 GitHub Release.