ci: harden release verification and governance

[anand-testcompare]

Summary

• add publish-time dist-tag verification to ensure the intended next or latest tag points to the exact version that was just published
• add RELEASE.md with release flow, required repository settings, verification commands, and rollback playbook
• update README to reference the new release operations guide

Repository governance change (already applied)

• created repository ruleset Required Status Checks (id 13348280) for default branch
• enforced required checks: Check, ValidatePrTitle, CodeQL

Validation

• bun run check
• bun run typecheck
• bun test
• bun run build