ci(release): build and publish every client on tag push

Both apps ship their own updater pointed at this repo's releases/latest, so a
release is not a convenience -- it is the update channel, and a half-finished
one reaches every install within ten minutes. The mac DMG has been published by
hand and the Windows client not at all, which is why arm64 and the
framework-dependent build have never been on a release at all.

The version check gates the whole workflow because the failure it catches is
silent and permanent: both updaters compare the tag against the version
compiled into the running app (herdi-win/Services/Updater.cs:112,
herdi-mac/Sources/Updater.swift:78), so an app built at 0.7.3 and shipped under
tag v0.7.5 offers an update, installs it, and offers it again forever.

Seven numbers in five files decide that version, and they disagree right now:
herdi-win says 0.7.3 while herdi-mac says 0.7.5. check-versions.py is the one
place they are written -- `--set X.Y.Z` rewrites all seven, a bare run reports
them, and a run with a tag exits 1 unless every one agrees.

Windows publishes both deployment modes per architecture because the updater
picks per install (Updater.IsUsableAsset) and an install whose asset is missing
gets nothing -- or a build that cannot start on its machine. The release is
created with its assets in one call, so it is never briefly latest and empty.
workflow_dispatch builds everything and skips the release job, as a dry run.