docs: add a release skill

[frantufro]

Adds .claude/skills/release/SKILL.md, alongside the existing rust-dev,
rust-review and git-merge skills.

It documents the release as it actually runs today: the four files that carry
the version and the verify job that compares them to the tag, the local gate,
the rebase-only merge, the tag push, and what each job in release.yml
produces.

It also records the things that are only obvious once you have hit them:

• --squash fails on this repository; rebase is the only merge mode.
• The .sha256 sidecars are consumed by both skulk update and
  bin/install.mjs, so a packaging change has to keep emitting them.
• The npm OIDC trust configuration has to be registered on the package's web
  access page, because the npm trust CLI on npm 11.x is rejected with an
  empty 400.
• A version spent on a failed release can never be republished, so the
  recovery is a new patch.
• The packument lags the registry write path, so a fresh publish can look
  missing for minutes.

CONTRIBUTING.md keeps its release checklist. The skill is the long form for
an agent driving the release.