Add selectable cross-platform release build and publication workflow

[physicsG]

Summary

Add a manual GitHub Actions workflow that can build release artifacts for any selected combination of Linux, Windows, and macOS, while keeping build, signing, and publication as separate protected stages.

Scope

• Refactor existing reusable build workflows into side-effect-free platform builders.
• Reuse dependency caches and current packaging logic.
• Support selectable targets through workflow_dispatch inputs:
  • Ubuntu 24.04 AppImage;
  • Windows Server 2022 NSIS installer and portable archive;
  • macOS 14 universal DMG.
• Allow a branch, tag, or commit SHA to be selected as the source ref.
• Optionally run the full automated test suite before packaging.
• Upload artifacts and checksums without publishing by default.
• Support explicit publication modes: artifacts only, draft release, prerelease, and production release.
• Restrict signing, notarization, and release credentials to protected environments.
• Preserve unsigned fork/QA builds when signing credentials are unavailable.
• Separate release publication from expensive platform compilation so failed publication does not require rebuilding.

Proposed workflow structure

.github/workflows/build_platform.yml
.github/workflows/release_manual.yml
.github/workflows/publish_release.yml
.github/workflows/release_tag.yml    # optional later

Recommended manual inputs

source_ref
build_linux
build_windows
build_macos
run_full_tests
sign_artifacts
publish_mode
version_label

Acceptance criteria

• A maintainer can select any combination of Linux, Windows, and macOS in the Actions UI.
• Selected builds produce correctly named downloadable artifacts.
• Windows produces both installer and portable artifacts.
• macOS produces a universal DMG and signs/notarizes only when explicitly authorized.
• Linux produces an Ubuntu 24.04 AppImage.
• Every artifact has a SHA-256 checksum and build manifest.
• artifacts-only mode never creates or updates a GitHub release.
• Draft, prerelease, and production publication are separate protected actions.
• Production release requires a matching version tag and successful full tests.
• Pull-request workflows cannot access signing secrets or publish artifacts as releases.
• Reusable builders never deploy nightly assets, push tags, or modify branches.

Dependencies

• Full test enforcement depends on Add pull-request CI quality gates and automatic test execution #7.
• Reuses existing build_check_cache.yml, build_deps.yml, and build_orca.yml logic after refactoring side effects out of the builder.

Design reference

• doc/ci_cd_strategy.md

[physicsG]

First implementation milestone is now on feature/selectable-release-workflow with draft PR #11.

Implemented:

• selectable workflow_dispatch inputs for source ref, Linux/Windows/macOS, tests, signing, publication mode, and version label;
• side-effect-free reusable platform builder;
• Ubuntu 24.04 AppImage, Windows NSIS + portable archive, and macOS universal DMG packaging;
• platform-specific dependency caches saved immediately after dependency compilation;
• optional macOS signing/notarization isolated behind the release-signing environment;
• SHA-256 sidecars and per-platform JSON build manifests;
• selected-ref execution through the existing CI test workflow;
• protected draft/prerelease/production publication workflow, with artifacts-only as the default;
• production checks for full tests, all three platforms, an annotated version tag, and tag/version consistency;
• release helper smoke tests in the required CI quality workflow;
• removal of .github/workflows/publish_docs_to_wiki.yml, which targeted the upstream SoftFever wiki and is not appropriate for physicsG.

Still in progress:

• validate the first clean PR CI run for the final branch head;
• exercise platform packaging safely and fix runner-specific failures;
• migrate or retire legacy nightly deployment side effects in build_all.yml, build_deps.yml, and build_orca.yml;
• document required GitHub environments/secrets before marking the PR ready.

[physicsG]

Platform validation update:

• Added a temporary unsigned PR smoke workflow to exercise the actual Linux, Windows, and macOS dependency/build/package paths without signing or publication permissions.
• The first macOS attempt failed before compilation because the hosted runner's newer CMake rejected a legacy dependency cmake_minimum_required policy range.
• Restored the repository's previous CMake 3.28 setup in the side-effect-free builder; the targeted macOS rerun has passed the former configure failure and is compiling dependencies.
• Added failure diagnostic artifacts for dependency and application build logs on every platform.
• Normal PR quality checks currently pass: actionlint, yamllint, release helper tests, unsafe-input regression tests, checksum tamper detection, builder side-effect enforcement, documentation, and repository hygiene.

The PR remains draft while unsigned platform packaging smoke tests complete. The temporary smoke workflow will be removed before the final PR revision.