ci(release): add tag-triggered signed release workflow

[yves-vogl]

Summary

• Adds .github/workflows/release.yml, a tag-triggered (v*) release workflow that builds, signs, notarizes, and packages Triptych's AU/VST3/Standalone artefacts on macOS, and packages an unsigned VST3/Standalone build on Windows.
• Both jobs upload their zipped artefact to the GitHub Release for the pushed tag via gh release upload.
• Only fires on v* tag pushes — it does not run on PRs or branch pushes, so it has no effect on this PR's own CI run.

Security model

• Trigger is push: tags: ['v*'] only — tag pushes never carry fork-PR secrets, so signing credentials are never exposed to untrusted code.
• The Apple Developer ID certificate is imported into a throwaway keychain ($RUNNER_TEMP/release.keychain-db, random password) that is deleted unconditionally in an if: always() step.
• permissions: contents: write only, scoped to attaching release assets.
• Depends on five org-level secrets that are not yet configured: APPLE_API_KEY_ID, APPLE_API_ISSUER_ID, APPLE_API_KEY_P8, APPLE_CERT_P12, APPLE_CERT_PASSWORD. Yves is adding these at the org level. Until they exist, a tag push would fail at the signing/notarization step — this fails closed and is safe (no unsigned binaries would be silently released from the macOS job).
• The Windows job intentionally packages unsigned binaries by design (no Windows code-signing cert in scope yet); this is explicit in the job name (Windows release (unsigned)) and is not a gap to fix here.

Notes on adaptation from the suite template

• Artefact discovery uses find … -iname "*.vst3|*.component|*.app|*.exe" instead of a hardcoded build/Triptych_artefacts/Release/... path, mirroring the same defensive pattern this repo's ci.yml already uses in its "Locate plugin artefacts" step (JUCE's artefact path may or may not include a Release/ segment depending on single- vs multi-config generators).
• CMake target name confirmed as Triptych (from CMakeLists.txt's project()/juce_add_plugin() and cross-checked against ci.yml's ARTEFACT_ROOT="build/Triptych_artefacts").
• .github/workflows/ci.yml and all other existing files are untouched — this PR only adds the new workflow file.

Test plan

• YAML parses (python3 -c "import yaml; yaml.safe_load(open('.github/workflows/release.yml'))")
• Existing ci.yml build/test/pluginval/auval workflow is green on this PR (release.yml does not run on PRs)
• First v* tag push after org secrets are configured, to validate the signing/notarization/packaging steps end-to-end