Harden automatic releases on merge to main

[Copilot]

Make main-branch releases consistently versioned, complete before publication, and safe to retry.

• Gating and versioning

  • Package the exact commit from successful main-push checks; newer commits no longer cancel earlier checks.
  • Align tags and installer versions using v<base>-main.<Tests run number>.

• Packaging and publication

  • Validate Windows, macOS, and Linux installers; generate SHA-256 checksums using upload-safe filenames.
  • Upload assets to a draft before publishing. Retry incomplete drafts without modifying published releases.
  • Keep packaging read-only and restrict write access to publication.

• Release policy

  • Preserve unsigned prereleases without replacing the latest stable release.
  • Document permissions, branch protection, version updates, and recovery.