ci: publish verified release drafts automatically

[lynnswap]

Summary

• Add a separate release workflow publishing job that runs only after release verification tests pass.
• Keep package tests on read-only repository permissions and scope contents: write to the final publish job.
• Validate the release tag ref, draft release, and expected DMG asset before switching the release out of draft.
• Update local release script and README wording to describe the automated publish step.

Testing

• swift test --build-system swiftbuild --no-parallel
• xcodebuild test -project Tools/ReviewMonitor/CodexReviewMonitor.xcodeproj -scheme CodexReviewMonitor -destination 'platform=macOS,arch=arm64' CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO
• codex-review clean before shipping: D0384E05-053B-41F9-8E5A-65CB5A490A74