feat: create a GitHub Release on every version tag

A pushed v*.*.* tag published to npm/GHCR but never created a GitHub
Release object — those are separate from git tags and need an
explicit API call. Adds a github-release job using the Actions-
provided GITHUB_TOKEN (no new secret).