feat: Add automated release workflows with waybill SBOM generation

[mfahlandt]

Description

Automates the release process, which was previously fully manual (build dist/, tag, create the GitHub Release by hand).

This PR adds two GitHub Actions workflows and documentation:

• .github/workflows/release.yml — triggered on v* tag push:
  1. Verify: npm ci, build, lint, test, and checks that the committed dist/ bundle matches a fresh ncc build (fails if npm run pack was forgotten before tagging)
  2. SBOM: generates an SPDX 2.3 SBOM with waybill (pinned version, SHA256-verified download)
  3. Signing: signs the SBOM with cosign (keyless via GitHub OIDC) and creates a SLSA build provenance attestation
  4. Release: publishes a GitHub Release with auto-generated notes and the SBOM + signature bundle + provenance attached. Tags containing -rc/-alpha/-beta are marked as pre-releases automatically.
• .github/workflows/pre-release.yml — manual workflow_dispatch for release candidates: creates the tag from the chosen branch and publishes a pre-release using the same verification and SBOM pipeline. The tag pushed by this workflow does not re-trigger release.yml (GitHub suppresses recursive GITHUB_TOKEN triggers).
• docs/releasing.md — describes the release process, including how to verify the SBOM signature (cosign verify-blob) and provenance (gh attestation verify); linked from README.md and docs/overview.md.

All third-party actions are pinned by commit SHA; the waybill binary download is verified against a pinned SHA256.

Fixes # (no issue)

Testing

• Validated YAML syntax of both workflows
• Tested waybill SBOM generation locally against this repository: valid SPDX 2.3 output with 648 packages including license enrichment (deps.dev / ClearlyDefined)
• Verified the pinned waybill tarball SHA256 and archive layout used by the install step

Checklist:

• I ran npm run all to lint and build my code (no source code changes — workflows and docs only)
• Note any new dependencies these changes bring in: CI-only tools — waybill (SHA256-pinned binary), cosign, actions/attest-build-provenance, softprops/action-gh-release (all pinned by commit SHA). No npm dependencies added.
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (docs/releasing.md, README.md, docs/overview.md)
• My changes generates no new warnings