Consolidate and validate release automation

[sobolevnrm]

Summary

• replace the duplicate release-branch workflow with one tag-based publisher
• prepare and upload a release-candidate artifact on pull requests, main pushes, and manual runs without publishing
• require release tags to match VERSION and require nonempty curated release notes
• validate exactly three tested platform ZIP packages before publication
• limit contents: write to the tag-only publishing job
• update the documented release procedure

This supersedes #306 and #307 by including softprops/action-gh-release@v3 and actions/download-artifact@v8.0.1 in the consolidated workflow.

Validation

• workflow YAML parses with no editor diagnostics
• release-note extraction succeeds for the current version
• matching and mismatching tag guards were exercised locally
• a completed CI run produced exactly three matching Darwin, Linux, and Windows ZIP artifacts
• the normalized release-candidate directory was assembled locally from those real artifacts
• independent read-only review found no blockers

The publishing job remains skipped on this PR. The new Validate Release Inputs job is the non-publishing end-to-end dry run.