Add GitHub release pipeline

[jmcte]

Summary

• add a tag-triggered GitHub Release workflow that validates the tag, runs fast checks, builds sdist/wheel, writes SHA256 sums, extracts the matching changelog section, and publishes release assets
• add scripts/release/dry-run.sh for pre-tag build verification
• add a PR Fast CI package-build job under the required CI Gate for release/packaging changes
• flip project.bootstrap.yaml release capability to github-release

Verification

• bash -n scripts/release/dry-run.sh
• bash scripts/ci/check-ci-contract.sh
• PYTHON_BIN=/private/tmp/mailplus-release-venv/bin/python bash scripts/release/dry-run.sh --skip-fast-checks
• bash scripts/ci/run-fast-checks.sh

Closes #86.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2d7e7037aa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid hard-failing releases on missing CHANGELOG.md

This workflow unconditionally exits when CHANGELOG.md is absent, but the repository currently has no CHANGELOG.md, so every tag push that triggers release.yml will fail before creating a GitHub Release. Because this commit also enables capabilities.release, the new release path is effectively unusable until a changelog file is added or a fallback note strategy is implemented.

Useful? React with 👍 / 👎.