[codex] Link release workflow to compliance tests

[parithosh]

Summary

This links the release workflow to the long-running compliance test workflow without merging the two workflows together.

• release.yml now dispatches comptests.yml after the release publish job succeeds.
• comptests.yml accepts an optional release_tag input, uses it in the workflow run name, and renames final tarballs as <release-tag>-compliance-<config>.tar.gz.
• Release-tagged compliance runs upload their final tarballs back to the matching GitHub Release once generation finishes.
• Manual and scheduled compliance runs keep their existing behavior when release_tag is not provided.

Why this matters

Reference release artifacts and compliance test artifacts are currently produced independently, even though downstream consumers need to know which compliance tests correspond to which consensus-specs release. The compliance tests take long enough that they should remain in their own workflow, but the release process should still produce an explicit, discoverable link to the matching compliance tarballs.

With this change, a release can finish on its normal timeline while the compliance tests continue asynchronously. When the compliance workflow completes, its output is clearly tagged with the release version and attached to the same release page.

Security notes

The compliance workflow keeps a read-only default token and only grants write permissions to the packaging job that needs to delete intermediate artifacts and upload release assets.

For release-tagged runs, the workflow rejects configurations where:

• repo is not the current repository
• ref does not exactly match release_tag

The generation checkout also disables persisted credentials, and release asset upload does not use --clobber, so existing release assets are not silently overwritten.

Validation

• actionlint -shellcheck= .github/workflows/release.yml .github/workflows/comptests.yml
• YAML parse check for both workflow files
• git diff --check -- .github/workflows/release.yml .github/workflows/comptests.yml