ci(release): add tag-triggered signed release workflow

[yves-vogl]

Summary

• Adds .github/workflows/release.yml, a tag-triggered release workflow that builds, signs, notarizes, and packages the macOS AU/VST3/Standalone artefacts and builds an unsigned Windows VST3/Standalone, then attaches both zips to the GitHub release for the pushed tag.
• Generated from the shared suite template (/Users/yves/Development/Audio/.scaffold/release-workflow-template.yml) with __NAME__ -> Overture, matching the pattern already in use in sibling repos (e.g. nave).
• Artefact discovery uses find-based lookup (via a small find_artefact_dir helper) instead of a hardcoded Release/ path, mirroring the workaround already present in this repo's ci.yml ("Locate plugin artefacts" step) for JUCE's single- vs multi-config path differences.

Trigger & security model

• Trigger: push of tags matching v* only — never runs on pull_request events, so fork PRs can't reach org secrets.
• Signing: macOS build imports the Apple Developer ID cert into a throwaway keychain (security create-keychain), signs + notarizes + staples, then deletes the keychain in an if: always() post step.
• Permissions: contents: write only, scoped to attaching release assets via gh release upload.
• Windows build is intentionally unsigned — no Windows code-signing cert exists for this suite yet; the artefact ships as-is, consistent with sibling repos.

Dependencies / open items

• Depends on org-level secrets that are not yet configured: APPLE_CERT_P12, APPLE_CERT_PASSWORD, APPLE_API_KEY_P8, APPLE_API_KEY_ID, APPLE_API_ISSUER_ID. Until those exist at the metal-up-your-ass org level, the release-macos job will fail at the "Import signing certificate" step on an actual tag push. This PR only adds the workflow file; it does not provision secrets.
• No existing files under .github/ were modified — this PR adds release.yml only.

Test plan

• python3 -c "import yaml; yaml.safe_load(open('.github/workflows/release.yml'))" — YAML parses cleanly.
• Diffed the generated file against sibling nave/.github/workflows/release.yml with plugin names normalized — structurally identical apart from Overture/Nave substitution.
• Not exercised against a real tag push (requires org secrets described above); merging this does not trigger a release run since it only fires on v* tags.