ci(release): split releases by package

[eersnington]

• just release takes a target and releases only that target. Each target has its own version, tag, and GitHub release.
• Sandbox Agent stops publishing packages/*, and a root package release never touches crates, binaries, or Docker images.

just release sandbox-agent --version 0.4.3
just release pi --version 0.2.0
just release sandbox-adapter --version 0.1.1

Target	Publishes	Tag
sandbox-agent	Crates, npm packages, binaries, Docker images	v<version>
pi	@rivet-dev/pi	pi-v<version>
sandbox-adapter	@rivet-dev/sandbox-adapter	sandbox-adapter-v<version>

• The targets live in scripts/release/target.ts. release.yaml takes a target input and runs the binaries and Docker jobs only for sandbox-agent.
• A root package release builds the package with its workspace dependencies, then publishes it. It fails when the version is already on npm, or when a workspace dependency it pins is not on npm yet.
• --patch and --minor bump from the target's own tags. A package's GitHub release is never marked "Latest", so the badge stays on Sandbox Agent.

[railway-app]

This PR was not deployed automatically as @eersnington does not have access to the Railway project.

In order to get automatic PR deploys, please add @eersnington to your workspace on Railway.