ci: gate and publish release candidates

[XiaoHai67890]

Change

• add a strict workspace SemVer and tag-equality gate with reproducible release metadata
• publish GitHub prereleases only after the full conformance and G4 security gates pass
• attach conformance records, the normative specification and vectors, G4 evidence, Solidity sources, and all four TypeScript artifacts
• document the Critical/High review threshold and exact v<version> release procedure

The workflow intentionally remains blocked until independent review evidence exists at audits/g4/external/external-review.json.

Protocol checklist

• The change stays within release tooling and documentation boundaries.
• No normative hashing or state-machine behavior changes.
• Release-gate behavior has positive and negative tests.
• pnpm check passes.
• Clean-checkout conformance passes for workspace, core TS, minimal TS, and Solidity.
• No unassigned ERC number or raw private memory was introduced.

Verification

• pnpm check: 70 Solidity tests pass; invariant executes 128,000 calls
• CONFORMANCE_CLEAN_CHECKOUT=1 pnpm conformance:gate: pass
• pnpm release:test: 8/8 pass
• wrong tag is rejected; matching tag is accepted
• release asset smoke test produces 10 files and all SHA-256 checks pass
• pnpm release:check reaches G4 and stops only on the missing independent-review evidence, as intended