Add release tag helper

[austin-smith]

What Changed

• Add an executable release helper that reads the Xcode marketing version and pushes the matching Git tag.
• Add clean-tree, origin/main, duplicate-tag, confirmation, and dry-run safeguards.
• Validate that release tags match MARKETING_VERSION before signing and notarization begin.

Why

Provide a reliable one-command path for triggering GitHub releases while preventing stale commits, duplicate tags, and version mismatches.

Validation

• bash -n scripts/tag-version.sh
• Successful isolated ./scripts/tag-version.sh --dry-run for version 0.7.0 / tag v0.7.0
• Release workflow YAML parsed successfully
• git diff --check
• macOS test suite: 89 passed, 2 skipped