[codex] Add release tag enforcement

[erikzrekz]

Summary

Adds the first release workflow for radius-cli so npm publishes, git tags, npm dist-tags, and GitHub releases stay tied to the same package version.

The workflow runs on v* tag pushes and manual dispatch. It:

• validates that the tag is semver-like and matches package.json
• runs npm ci, npm test, and npm run build
• publishes radius-cli to npm with latest for stable versions and the prerelease label for prereleases, e.g. alpha
• skips npm publish if that exact package version already exists
• explicitly ensures the npm dist-tag points at the released version
• creates the matching GitHub release, marking prerelease tags as prereleases
• skips GitHub release creation if the release already exists, so failed workflow retries are less brittle

Also adds RELEASE.md with the intended stable and alpha release process.

Baseline

radius-cli@0.1.4 is already published on npm, and v0.1.4 has now been backfilled as the current GitHub Latest release. This PR is for future releases after that baseline.

Operational note

Before using this for a real release, the repository needs npm publish auth configured through either:

• npm trusted publishing for this GitHub repository/workflow, or
• an NPM_TOKEN repository secret with publish access to the radius-cli package

Validation

• npm test
• npm run build

actionlint is not installed locally, so workflow syntax has been reviewed manually.