[CI] Release-PR + tag-triggered publish workflows

[justin13888]

Description

Third and final PR in the release-automation stack for #18 (stacked on #357). Adds the automated, reviewable release flow.

Review after #356 and #357 — base is build/version-sync-xtask.

Flow

1. prepare-release.yml (workflow_dispatch, optional explicit version): computes the next version with convco version --bump, runs just set-version across all packages, regenerates the CHANGELOG (titled with the version), and opens a release/vX.Y.Z PR. The PR's own CI is the "all checks before release" gate; the CHANGELOG is hand-editable there.
2. Merge the release PR → chore(release): vX.Y.Z lands on master.
3. release.yml (push: master): detects the release commit (robust to the repo's merge-commit strategy + an already-existing tag), builds the capsule CLI for Linux/macOS (Windows best-effort), and publishes a GitHub Release with convco-generated notes and the binaries attached. gh release create also creates the tag — so build + publish happen in one run, avoiding the GITHUB_TOKEN re-trigger pitfall (no PAT needed on this path).

Other

• justfile — changelog recipe takes an optional title so a release section is titled vX.Y.Z (default stays Unreleased).
• CONTRIBUTING.md — documents local setup (mise install + hooks), enforced semantic commits, and the full release process.

One-time setup (documented in CONTRIBUTING): add a repo secret RELEASE_PAT (PAT with contents + pull-requests write) — used only so the release PR triggers CI (PRs opened with the default token don't).

Verification (local)

• Both workflow YAMLs parse (ruby YAML.load_file).
• just changelog 0.2.0 titles the section ## v0.2.0; convco version --bump → 0.1.0; convco changelog -m 1 --unreleased <ver> produces titled notes.
• markdownlint → 0 errors. convco commit checks pass.
• The build/publish jobs (multi-OS, GitHub Release creation) are inherently CI-only and can't be exercised locally; the first prepare-release run with an explicit version is the end-to-end smoke test.

Related Issues

Closes #18 (stack 3/3).

Contributor Checklist

• I have signed the Contributor License Agreement.
• My code follows the project's style guidelines according to CONTRIBUTING.md.
• Tests pass (config/recipe checks verified locally)
• No sensitive info / secrets
• Docs updated (CONTRIBUTING release + setup sections)

[cloudflare-workers-and-pages]

Deploying capsule with    Cloudflare Pages

Latest commit:	75007ae
Status:	✅  Deploy successful!
Preview URL:	https://3414ed96.capsule-22k.pages.dev
Branch Preview URL:	https://ci-release-workflows.capsule-22k.pages.dev

View logs