fix(release): restore the workflow that actually shipped 0.6.5 -> 0.6.9

The v0.7.0 prep commit 3d332eb overwrote a release workflow with a five-release
track record with an untested rewrite. Every failure found while trying to tag
was latent in that rewrite, not in the project:

  * it built AND published an sdist, which docs/RELEASING.md forbids;
  * its smoke test called get_decoder_info, which does not exist;
  * it added musllinux and Linux-aarch64 targets README says are not published,
    and neither built or smoke-tested cleanly;
  * its publish gate read `|| inputs.publish` - a dispatch input is a string and
    every non-empty string is truthy, so publish=false evaluated TRUE and the
    publish job was live on runs explicitly asked not to publish;
  * it dropped to 6 abi3 wheels while README documents 15.

Restored from the v0.6.9 checkout: 3 platforms x 5 CPython versions = the 15
wheels README documents and PyPI already carries, and a tag-only publish gate
with no inputs.publish term at all.

Kept from the rewrite, deliberately:
  * the 12-chunk secret restore. The proven file inlined 3 chunks and gzip; the
    core has outgrown that (12 chunks, xz), which is the legitimate reason it
    was rewritten in the first place. This is the one change that could not be
    avoided, and it now also runs check-manifest so a stale-secret build fails
    loudly instead of silently compiling old source.
  * the strict dependency gate, which caught RUSTSEC-2026-0204.
  * a smoke test that decodes and asserts H@c == s rather than only importing.

Dropped: the sdist job, musllinux, Linux aarch64, and macos-intel (it hangs).
Publish additionally refuses to run if any .tar.gz reaches dist/ or if fewer
than 15 wheels were collected.

Author: Guillaume Lessard