fix: create releases after artifacts

[iancleary]

Summary

• keep just cut-release as the release entrypoint, but dispatch and wait for the checked-in release workflow instead of creating the GitHub release locally
• run contributor checks and every supported platform build before assembling and verifying artifacts and attestations
• make gh release create the workflow's final step so failed prerequisites leave no release tag or published release
• pin attestation verification to the immutable commit targeted by the release tag
• allow a clean, already-versioned main to resume an unpublished release after a failed workflow
• update the managed cut-release and create-release-process skills, repo guidance, and release documentation

Root cause

The release workflow was triggered by the published release event. That required the tag and GitHub release to exist before platform builds, artifact assembly, and attestation verification had run.

Verification

• just ci
• cargo check
• just release-process-check
• shell syntax checks for the release, installer, and regression-check scripts
• YAML parse check for .github/workflows/release-artifacts.yml

The structured autoreview helper was also attempted, but its required TruffleHog dependency is not installed in the local environment.

Closes #111