ci(release): build the Release config on main and release branches

[datlechin]

Why

The Release configuration, the universal build and the packaging first run on a tag today, so a broken DMG or plugin zip costs a version number (v0.67.1). Step 15 of the release rewrite.

Change

• release-build.yml (Release Build) runs on pushes to main and release/**. It builds the app and every registry plugin, universal and unsigned, then packages them the way a tag will.
• scripts/release/build.sh and package.sh: archive or build, then lipo and load checks. Packaging writes the DMG, the .tar.xz (extracted and compared with the app), the plugin zips and the dSYM zips.
• AllPlugins now depends on RegistryPlugins and BundledPlugins. check-plugin-manifest.py checks them against the registry file and the app's embedded set.
• detect-changed-paths.sh gets a release suite. A new branch diffs against its merge base with main. The test workflows also run on release/** pushes.
• The two helper tools skip install, so the archive is an app archive -exportArchive accepts. The HANA helper takes the release's --timestamp.

Verified

Local, Xcode 27.1, clean build/release, warm SPM cache:

• build.sh app --unsigned: 599 s
• build.sh plugins --unsigned: 186 s
• package.sh app 0.0.0-dev --unsigned: 91 s
• package.sh plugins 0.0.0-dev --unsigned: 23 s

Every bundled and registry plugin loads. actionlint is clean.

Not in this PR

• Signed builds need scripts/release/ExportOptions.plist (step 23) and the template's hardened runtime (step 12).
• dist/ is not gitignored yet.