Automate immutable public-contract releases

[RollNuts]

Summary

Add a permanent release path for the independently versioned public contract.

Behavior

• on a reviewed main change to the release workflow, package version, or changelog, read the package version;
• reject 0.0.0 and require a matching changelog heading;
• create the missing annotated vX.Y.Z tag at the reviewed merge commit;
• create the corresponding GitHub Release;
• leave an existing tag untouched, so released schema IDs remain immutable.

This PR contains no product implementation or customer data. The normal public-contract CI still validates all contract assets before merge.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.