#406 Create GitHub Releases after publish

What changed

• Added a tag-only github-release job after the verified PyPI publish job.
• Download the already-verified distribution artifacts and create the GitHub Release with generated notes and attached wheels/sdist.
• Mark alpha, beta, and release-candidate tags as prereleases and make reruns replace assets safely.
• Kept all workflow_dispatch runs, including dry runs, unable to create a release.
• Aligned docs-promotion comments/runbook text and added workflow invariants.

Why

Docs promotion requires both the PyPI version and a GitHub Release, but the core release workflow previously created only the PyPI publication. No automated owner completed the second half of that contract.

Impact

A real v* tag now produces the GitHub Release only after publication succeeds, while manual validation remains non-publishing.

Validation

• .venv/bin/pytest -q tests/test_verify_ci_workflow.py — 59 passed
• .venv/bin/python scripts/verify_ci_workflow.py
• Ruff lint and format checks on verifier code/tests

Fixes #398

Summary by CodeRabbit

• New Features

  • GitHub Releases are created automatically after successful PyPI publication.
  • Verified packages and signed provenance are attached to releases.
  • Release assets, metadata, notes, and PyPI packages are cross-checked for consistency.
  • Pre-release tags are detected automatically, with safe retry handling for updates.
  • Documentation deployments undergo bounded readiness and integrity checks before promotion.

• Documentation

  • Updated release and production-readiness guidance.

• Tests

  • Expanded validation for releases, documentation deployment, package contents, and promotion safeguards.