Enforce the house style and script the release tag

[alexander-wang03]

What this changes

Turns three lessons from the 0.3 cycle into checks: tools/check_style.py fails CI on em-dashes and the six banned words, tools/release_check.py fails when emet-hal's README does not name every entry point the package registers, and tools/tag_release.py makes the signed release tag after refusing a dirty tree, the wrong branch, a version the packages do not declare, or a missing signing key. CONTRIBUTING.md and RELEASING.md describe them.

Why

Each check replaces a rule a person kept missing: 178 em-dashes passed review over three releases, the HAL README shipped 0.3 naming four of eleven plugins, and v0.3 first went up as an unsigned tag. A rule a person applies gets skipped; a check does not.

---

Checklist

• Commits are signed off (git commit -s). See CONTRIBUTING.md.
• python tools/check_layering.py . and python tools/release_check.py . pass.
• pytest passes in emet-sdk, emet-hal and emet-engine.
• New behaviour has a test and a caller.
• Anything taken from a paper or repository is cited at the point of use and in CITATIONS.md.

If this touches the contract layer

Leave blank: it does not.

• This was discussed in an issue first.
• Existing manifests and soul bundles still validate.
• New schema fields are tagged P0, RSV, or V1 in DESIGN.md.

Design rules

• The soul names no hardware.
• Every fallback chain still terminates in a voice rung.
• emet_sdk imports nothing internal; emet_hal and emet_engine import emet_sdk only.
• Memory is not namespaced by body.
• A missing plugin is still distinct from a schema error.