Auto-publish releases at the end of the release workflow

[jssblck]

Why

The release workflow built the platform matrix, created a draft GitHub Release, and then left publishing to a human. That manual step is the only thing standing between pushing a vX.Y.Z tag and a live release, so it may as well be automated.

What changed

• Added a final Publish GitHub release step to .github/workflows/release.yml that runs gh release edit "$TAG" --draft=false, flipping the release live at the end of the workflow.
• Kept the existing draft-creation step unchanged, so the release is still created as a draft first: GitHub generates the changelog notes and attaches every asset (the .tar.gz archives plus checksums.txt) to a fully-formed release before it is visible. Only then does the publish step flip it, so a consumer never catches a release with missing notes or half its assets.
• The new step reuses the same if: ${{ !inputs.dry_run }} guard, so a workflow_dispatch dry run still builds and packages without publishing.
• Rewrote the Write release summary step to report the release as published and link to the release tag, dropping the old "review the draft, publish when ready" next-steps list.
• Updated the release runbooks in AGENTS.md and CONTRIBUTING.md to describe the release as auto-published rather than a draft awaiting a human.

The --prerelease/--latest selection is unchanged, so a pre-release tag (v0.2.0-rc.1) still publishes as a prerelease. The release job already carries permissions: contents: write and GH_TOKEN: ${{ github.token }}, which covers gh release edit, so no permissions change was needed.

Testing

• nudge check (clean: 64 files, no Unicode dashes).
• actionlint is not installed on this machine, so the workflow YAML was not machine-linted. The change is an added step plus a --draft to --draft=false edit mirroring the existing gh usage in the same job.

This only touches the release workflow and its docs, which are not a downstream user surface, so per AGENTS.md the blast radius is limited to Bastion's own CI.

Schema or governance impact

None. No changes to the reviewer schema, the verdict/event schema, local/GitHub surface parity, or the governance model.

[github-actions]

Bastion review

Passed. All 3 gate(s) passed. 4 reviewer(s) ran, 75s, 696065 in / 10240 out / 511360 cached tokens.

Reviewer	Mode	Verdict	Summary
release-surface-robustness	gate	pass	No robustness issues found in the release publishing change.
shell-script-footguns	advisor	advisory	No shell or PowerShell portability issues found in the changed code.
contributor-docs-in-sync	gate	pass	Release workflow changes and contributor docs agree; no stale release-runbook claims found.
prose-anti-slop	gate	pass	Changed prose is clean.

_{Posted by Bastion. Full transcripts are attached to the workflow run as an artifact. These checks were posted under the shared GitHub Actions app, so with other workflows on the commit they can cluster under one of those; set up a dedicated app to give them their own group.}