feat: automate verified npm and GitHub releases (#91)

* feat: automate verified npm and GitHub releases

* fix: harden release backfills and changelog labels

* fix: address all release automation review feedback

* fix: harden release queues and signing verification

* fix: enforce protected release tag and version checks

* test: derive release workflow versions from the current manifest

* fix: resolve release commits from exact tag objects

* fix: recover verified releases and address review feedback

* fix: preserve manual release-note exclusions

* fix: harden release automation review safeguards

* fix: bind release provenance to authenticated workflow runs

* fix: validate release provenance attempts and annotated tags

* fix: reconcile release metadata and initial publication safely

* test: drain mocked release verification input on macOS

* test: stabilize provenance mock pipelines on macOS

* fix: preserve latest status when reconciling existing releases

* fix: reconcile absent latest releases and managed labels

* fix: verify release API status and pin runtime minimum

* test: stream oversized workflow fixtures on Windows

* fix: fail closed on existing release lookup errors

Author: mldangelo-oai

.github/release.yml

@@ -0,0 +1,17 @@
+changelog:
+  exclude:
+    labels:
+      - skip-release-notes
+  categories:
+    - title: Features
+      labels:
+        - enhancement
+    - title: Fixes
+      labels:
+        - bug
+    - title: Documentation
+      labels:
+        - documentation
+    - title: Other changes
+      labels:
+        - "*"