[v1.0] Automate GitHub releases from version tags

[codeforester]

Goal

Make every published base-cli version discoverable through a consistent GitHub Release.

Scope

• Trigger release-note generation from an approved version tag.
• Attach checksums, SBOM, provenance, and distribution artifacts where appropriate.
• Validate that the tag, VERSION, package metadata, changelog section, and release title agree.
• Preserve protected-environment approval for production publication.

Acceptance criteria

• A tagged release creates or updates the corresponding GitHub Release automatically.
• Release assets are traceable to the exact published artifacts.
• The workflow rejects mismatched versions or missing release notes.
• Recovery and rerun behavior is documented.

Project fields

• Status: Backlog
• Priority: P2
• Area: CI
• Initiative: v1.0 Readiness
• Size: S