ci: automate release tag dispatch

[sdsrss]

Summary

• add a trusted post-merge workflow that detects a stable package version increase
• create or exactly verify an annotated v<version> tag at the integrated commit
• dispatch the existing Release workflow with the tag as ref while preserving direct tag-push compatibility

Security and release behavior

• the privileged job uses only contents: write and actions: write
• it reads repository files through the GitHub API and never checks out or executes pull-request code
• unchanged versions are a no-op; downgrades, non-stable versions, and conflicting tags fail before ref mutation
• this PR does not change package.json, so merging it must not create a tag or start npm publication

Validation

• node scripts/tests/workflow-static.test.js — 8 passed, 0 failed
• node scripts/tests/distribution.test.js — 46 passed, 0 failed
• node scripts/lint-argv.js --json — []
• workflow YAML parsed with PyYAML 6.0.1
• npm pack --dry-run --json — 137 files
• npm run check — exit 0, including phase 4 and ShellCheck
• live guard confirmed /home/sds/.codex was unchanged