[Summer110622]

Summary

Add a reproducible release path for marv-server-engineering.

Changes

• add .github/workflows/release-plugin.yml for v*.*.* tag pushes;
• require the tag to exactly match the plugin manifest version;
• run scripts/validate_plugin.py --check-urls before publishing;
• package the plugin as marv-server-engineering-vX.Y.Z.zip;
• generate and upload a SHA-256 checksum;
• create the GitHub Release using the GitHub CLI and the repository token, without a third-party release action;
• add RELEASING.md with the exact release and post-release verification process;
• refresh 0.2.0 release notes to reflect the now-public Privacy/Support/CI state;
• keep the high-resolution MARV-owned listing logo as the remaining branding gate rather than upscaling the existing 16×16 favicon.

Release contract

For manifest version 0.2.0, the release tag must be v0.2.0. A mismatched tag fails before packaging or publishing.

Security

• release job grants only contents: write, required to create the GitHub Release;
• checkout remains pinned to the verified actions/checkout commit used by the validation workflow;
• no third-party release action is introduced;
• package validation and public URL validation are required before release creation.