Add tag-driven GitHub release workflow with version gate

[Copilot]

Changes proposed in this pull request:

• This PR adds automated GitHub Releases for version tags and enforces that release tags match the project version declared in version/version.py.
• Release automation
  • New workflow: .github/workflows/release.yml
  • Triggers on tag push pattern v*.*.*
  • Verifies tagged commit is on main before releasing
  • Creates a GitHub Release with autogenerated release notes
• Version/tag consistency guard
  • Strips v from github.ref_name
  • Loads VERSION from version/version.py
  • Fails the workflow when VERSION != tag
• Coverage for workflow contract
  • Added tests/test_release_workflow.py to assert:
    • tag trigger exists
    • main ancestry check is present
    • version check references version/version.py and VERSION
    • release action enables generated notes

- name: Check version matches tag
  run: |
    TAG_VERSION="${GITHUB_REF_NAME#v}"
    python - <<'PY'
    import pathlib, os
    values = {}
    exec(pathlib.Path("version/version.py").read_text(), None, values)
    if values["VERSION"] != os.environ["TAG_VERSION"]:
        raise SystemExit("version/version.py does not match tag")
    PY

Before submitting

• I've read and followed all steps in the Making a pull request
  section of the CONTRIBUTING docs.
• I've updated or added any relevant docstrings following the syntax described in the
  Writing docstrings section of the CONTRIBUTING docs.
• If this PR fixes a bug, I've added a test that will fail without my fix.
• If this PR adds a new feature, I've added tests that sufficiently cover my new functionality.