[nofuturekid]

What changed

• .github/workflows/release.yml: runs on a pushed tag v* and creates the GitHub release itself. Job verify (read-only: contents, actions, checks) refuses unless
  1. the tag is vX.Y.Z and equals version in plugin.json at the tagged commit,
  2. the commit is an ancestor of main,
  3. the commit has a successful check required from a pull_request run of ci.yml (scripts/release-green.sh, ported from obsbot4linux),
  4. CHANGELOG.md has a non-empty section for the version (scripts/release-notes.sh).
     Job release (the only one with contents: write) runs after verify, on tag pushes only, and uses that CHANGELOG section as the notes (same form as v0.29.0 / v0.29.1). If a check fails no release is created.
• workflow_dispatch dry run with inputs sha and version: runs every check, prints the release it would create, creates nothing.
• README: new "Releasing" section. CHANGELOG: line under Unreleased (as CI: check the QML on every pull request #132 did).
• Actions use the same SHA pins as ci.yml; shellcheck passes on scripts/*.sh.

Proof (scripts run locally against real data)

release-green.sh <main tip 43ed900>
required: success (ci.yml pull_request run 43386831872)
43ed900... is green: required (ci.yml)                        exit=0

release-green.sh <bc3e53a, old commit, never had a PR check>
release refused: bc3e53a... has no check "required" from a ci.yml pull_request run: it was never green as a pull request   exit=1

release-notes.sh <main tip> v0.29.1   -> prints the "### Fixed ..." section of 0.29.1, exit=0 (same text as the v0.29.1 release notes)
release-notes.sh <main tip> v9.9.9    -> release refused: plugin.json has version "0.29.1" at 43ed900..., the tag is v9.9.9   exit=1
release-notes.sh <main tip> 0.29.1    -> release refused: 0.29.1 is not a tag of the form vX.Y.Z   exit=1
release-notes.sh <commit with plugin.json 9.9.9, CHANGELOG unchanged> v9.9.9
                                      -> release refused: CHANGELOG.md has no non-empty section for 9.9.9   exit=1

The workflow itself cannot be dispatched before it is on main; the dry run on GitHub is done after landing.

Fixes #138