Create the release page for each tag

[mervin008]

Tagging a version published the module and nothing else. The release page
was a step somebody had to remember, and v0.3.0 of the three gateways and
their SDK went nine days without one: the module and the images were
served, and every Releases page still said v0.2.0 (certpilot/certpilot#101).

A new workflow, since this repository had none: the module needs only its
tag, but the Releases page is where somebody evaluating it looks first.

• An annotated tag's message becomes the notes. A lightweight tag gets
  GitHub's generated list of merged pull requests.
• Latest goes only to the highest vX.Y.Z tag. A patch to an older line
  leaves the badge where it is, and a tag with a suffix is a prerelease.
• A release that already exists is left alone, so re-running a tag's
  workflow, or writing the page by hand first, neither fails nor
  overwrites.
• It runs only on a tag push.

Verified by running the script against the real repositories, with
gh release create replaced by a stub that prints the command:

• an existing release was skipped
• the agent's annotated v0.2.0 tag produced a notes file from its message
• a lightweight tag produced --generate-notes
• the ACME gateway's v0.2.0 got --latest=false, and v0.3.0 --latest=true
• a stubbed v0.4.0-rc.1 got --prerelease

actionlint is clean. The job itself has not run yet: the first tag pushed
after this merges is its first real run.

🤖 Generated with Claude Code