Add guarded tag-driven release workflow

[Copilot]

Publishes the next version only from an annotated semantic-version tag on remediated main, while preserving v2.0.0 as historical.

• Release gating

  • Accepts only annotated vX.Y.Z tags whose commit is reachable from main.
  • Records and revalidates both the tag object and tagged commit before publication.
  • Runs standalone and Zi-managed functional suites on Linux and macOS.
  • Runs both modes on the minimum supported Zsh 5.8.1.
  • Runs staged system install/uninstall tests on Linux and macOS.
  • Runs CodeQL against the exact release commit using the checked-out source tree.

• Artifact integrity

  • Generates deterministic .tar.gz and .zip source archives from the tested commit.
  • Publishes and verifies SHA256SUMS for both archives.

• Release publication

  • Creates the GitHub release only after every functional, compatibility, installation, and SAST gate passes.
  • Includes generated notes, the tested commit, and the offline traditional installation flow.

• Documentation

  • Defines annotated tags as the version source.
  • Documents the artifact contract and checksum-based verification flow.

Fixes #75.
Related: #70.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.