Auto-publish bugn.exe to GitHub Releases on master push and v* tags

[somanysteves]

Summary

• Adds a release job to ci.yml that downloads the existing bugn-exe artifact and publishes it.
• Master push → updates a rolling latest pre-release in place (prerelease: true, make_latest: false so the "Latest" badge stays with real versioned releases).
• v* tag push → cuts a normal release with auto-generated release notes.
• Repository guard (github.repository == 'somanysteves/bug.n') prevents downstream forks from triggering release publishes.

End-user effect: people can grab bugn.exe from the Releases page without forking and building.

Test plan

• CI green on this PR (build-and-test runs; release job is skipped on PR events by design).
• After merge, master push creates/updates the latest release with bugn.exe attached.
• Push a throwaway v0.0.0-test tag to confirm versioned-release path; delete the tag/release after.
• Verify the "Latest" badge on the Releases page stays unset (since rolling release uses make_latest: false).

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds automated publishing of the built bugn.exe artifact to GitHub Releases, enabling end users to download binaries directly from the Releases page after master pushes or version tag pushes.

Changes:

• Trigger CI on v* tag pushes in addition to branch pushes.
• Add a release job that downloads the bugn-exe artifact and publishes it to GitHub Releases.
• Publish a rolling latest prerelease on master pushes and a normal, notes-generated release on v* tag pushes (guarded to only run in somanysteves/bug.n).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

For supply-chain security, consider pinning this third-party action to a full commit SHA instead of the mutable @v2 tag (e.g., softprops/action-gh-release@<sha>). Using tags can silently pick up compromised or breaking changes in the future.

[Copilot]

Same as above: pin softprops/action-gh-release to a specific commit SHA rather than @v2 to reduce supply-chain risk and ensure builds are reproducible.