Add guarded release tooling and release candidates

[nodeselector]

What

Add maintainer release tooling for stable and release-candidate tags.

• script/release <patch|minor|major> cuts the next stable release.
• script/release <patch|minor|major> --rc cuts or increments an RC for that same base.
• The script requires a clean, current main, runs the repository checks, creates an annotated tag, rechecks origin/main, pushes, and verifies the remote tag.
• The tag workflow verifies stable and RC tags before publishing binaries and attestations.
• RELEASING.md documents the release and Dependabot compatibility chores.

Release selection

From current main (37645dbdb769c9160ca46731db060e655dac7b49) and latest stable v0.1.6, the harness proves:

v0.1.6 -> v0.1.7-rc.1 -> v0.1.7-rc.2 -> v0.1.7

Validation

• script/release-test
• make fmt-check vet test test-stub
• gh actions-lock --no-interactive --json=findings .github/workflows/release.yml
• git diff --check
• Lockfile unchanged

[Copilot]

Pull request overview

Adds guarded tooling and documentation for stable and release-candidate publishing.

Changes:

• Adds stable/RC tag selection and release validation.
• Adds a release-selection test harness.
• Strengthens the publishing workflow and documents release procedures.

Show a summary per file

File	Description
script/release	Computes, validates, and pushes release tags.
script/release-test	Exercises stable and RC tag selection.
.github/workflows/release.yml	Validates tags before publishing artifacts.
RELEASING.md	Documents releases and Dependabot compatibility.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 4/4 changed files
• Comments generated: 5
• Review effort level: Balanced