feat: add profile-bound release publication

[szmyty]

Summary

• add six versioned release profiles for npm specifications, container images, binaries, static sites, PDF/A documents, and GitHub actions
• add a local validator that fails closed on unsafe paths, symlinks, incomplete or drifting checksums, missing profile evidence, and unstable provenance
• add a reusable default-branch release workflow that preserves deterministic evidence, verifies exact archive bytes, and never overwrites an existing release asset
• document the caller-owned signing, registry, container, and deployment boundaries; release Relay v1.4.0 after merge so consumers can pin this surface

Validation

• python3 scripts/validate_actions.py
• python3 -m unittest discover --start-directory tests --pattern "test_*.py" --verbose (152 passed)
• YAML parse and Bash syntax checks for all 8 workflows and 6 actions
• python3 -m compileall -q actions scripts tests
• JSON parse and git diff --check

Closes #4.