Add a release pipeline, and pull cookie past the range Dependabot flags

[thorstenalpers]

Two separate concerns, one commit each.

Release pipeline

There was none because none had been asked for. It follows the shape CleanMyPosts uses, minus the parts that belong to an updater this app does not have — no signing key, no latest.json, because nothing here checks an endpoint for a new version. If you want the updater too, that is a separate decision: it needs a key pair, a secret and an endpoint in tauri.conf.json.

Manual on purpose: the version lives in tauri.conf.json, so a release is a decision someone makes by bumping it, not something that falls out of a merge.

Two details worth the lines:

• It runs the same gate as CI before building. A release is the one build nobody checks afterwards.
• It refuses a version that is already tagged up front, rather than at git tag half an hour after the installer was built.

Notes come from release-notes/v<version>.md when it exists and from GitHub's own summary when it does not — a missing file should not lose a built installer.

Dependabot alert #1

cookie 0.6.0 arrives under @sveltejs/kit, which still pins ^0.6.0 in its newest release — there is no version of kit to upgrade to. An override is the only lever, and 0.7.2 is a drop-in for the parsing kit does with it.

The advisory could not reach this app in the first place: ssr = false on adapter-static, so nothing here ever parses a request header. Left alone it would still sit in every audit and every clone, and a real finding later would arrive in a list of noise.

npm audit now reports nothing. Locally: lint, svelte-check over 995 files, 303 tests and the build all clean.