ci: auto-create GitHub Release on tag push

The publish workflow already publishes to crates.io on tag push but
didn't create a GitHub Release, so prior releases were created by hand.
Add a `gh release create --generate-notes` step (and bump
permissions.contents to `write`) so future tags get a Release page
automatically with auto-generated notes — editable after the fact if
something more curated is wanted.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: lightsofapollo

.github/workflows/publish.yml

@@ -13,7 +13,7 @@ jobs:
     environment: crates-io
     permissions:
       id-token: write
-      contents: read
+      contents: write
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
@@ -24,3 +24,11 @@ jobs:
       - run: cargo publish
         env:
           CARGO_REGISTRY_TOKEN: ${{ steps.crates-io-auth.outputs.token }}
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          tag="${GITHUB_REF#refs/tags/}"
+          gh release create "$tag" \
+            --title "$tag" \
+            --generate-notes