[WRONG BRANCH] Add tag-triggered cross-platform release workflow

[Copilot]

The release process was tied to manual dispatch and did not start automatically when a release tag was pushed, so the repo had no native “tag -> GitHub release + binaries” path. This change adds a tag-driven release workflow that creates a GitHub release and packages binaries for the supported desktop platforms in one path.

• Summary

  • Add a push.tags: v* release workflow so version tags generate a release automatically.
  • Build and upload release artifacts for macOS, Linux, and Windows from the same tagged commit.
  • Publish SHA256 checksums alongside the release assets so downstream installers can verify artifacts.

• What changed

  • Tag release workflow
    • Triggers on pushed tags matching v*.
    • Creates the GitHub release with generated notes if it does not already exist.
    • Uses the tag ref as the release target and keeps release metadata aligned to the tagged commit.
  • Cross-platform binary build matrix
    • Builds Darwin x64/arm64, Linux x64/arm64, and Windows x64/arm64 binaries using Bun’s compile path.
    • Runs in a matrix so each target is built independently and uploaded as its own artifact.
  • Asset publishing
    • Uploads each compiled binary to the GitHub release under the published tag.
    • Generates checksums.txt after the artifacts are available and uploads it to the release as a final verification artifact.

• Result

  • Pushing a version tag now starts the release pipeline automatically, without requiring manual workflow dispatch.
  • Release artifacts are ready for distribution from the GitHub release page immediately after the build completes.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: .github/workflows/tag-release.yml.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev. hygiene: unsponsored_surface.

What to do

• Retarget this PR to dev — all contributions go to dev.
• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: .github/workflows/tag-release.yml.
• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ⬜ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

Its title has been prefixed with [WRONG BRANCH].
Automatic draft conversion failed (token cannot change draft status). Please convert this pull request to a draft manually. The required enforce-target check will keep failing until every issue above is resolved.