Fix automated release publishing

[matthewdorman]

Summary

• pass the explicit GitHub repository to gh release create in the tag-only publish job
• allow release publication to work without checking out a Git working tree in that least-privilege job

Root cause

The v0.1.0 build and artifact validation passed, but the publish job failed because GitHub CLI attempted to discover the repository from a local .git directory. The publish job deliberately downloads only the validated artifact and does not check out source.

The initial v0.1.0 release was completed manually from the exact validated workflow artifact. This change fixes automatic publication for future version tags.

Validation

• workflow YAML parses successfully
• release command now provides --repo "${GITHUB_REPOSITORY}"
• git diff --check clean