ci: harden the release workflow against a single flaky target

[Bccorb]

Prep for cutting 1.2.0. The release automation is wired correctly but has never completed a run, so this fixes the failure mode before #10 (the version bump) is merged.

What went wrong before

The v1.1.0 release was tagged, but its release.yml run was cancelled on the x86_64-apple-darwin build (macos-13). Because release (GitHub Release + Homebrew) and crates both needs: build, a cancelled build skipped all three. The result, still visible today:

• no GitHub Release exists, even for 1.1.0 (install.sh resolves releases/latest, which 404s)
• the Homebrew formula is stuck at 1.0.0, still pointing at the retired seamless-glance-distro repo
• crates.io has zero published versions

Changes

Cross-compile x86_64 macOS on the arm64 runner; drop macos-13. GitHub is retiring the Intel macOS runner, and it is exactly where the last release stalled. I verified the cross-build locally on an arm64 Mac, twice (with and without SDKROOT), against this exact dependency tree, aws-lc-sys and ring included — it produces a genuine Mach-O 64-bit executable x86_64. So this removes the flaky runner without risking the C-dependency build.

Decouple crates.io from the binary matrix (needs: [setup], not [setup, build]). The publish is source-only; gating it on six binary builds meant one flaky Mac runner skipped it. It stays continue-on-error, and cargo publish still compiles the crate first, so it will not push code that does not build.

Fail loudly on a missing platform. The release job now asserts all six binaries are present before publishing, so a silent gap cannot ship or leave the Homebrew formula pointing at a binary that was never uploaded.

Timeouts on the build (45m, cold builds of this tree run long), release (20m), and crates (25m) jobs, so a hung runner fails instead of lingering until someone cancels it — which is the state the last release ended in.

fail-fast: false is kept: one target failing lets the others finish, so a single run surfaces every failure and re-running failed jobs can complete the set.

Verification

• Both YAML files parse; job graph and matrix confirmed (no macos-13 runner remains).
• The one genuinely risky change, the macOS cross-compile, is verified locally end to end rather than assumed.
• release-helper.sh targets fells-code/seamless-glance, so a successful run overwrites the stale distro-URL formula.

What I can't verify locally: the full release.yml run itself. GitHub Actions can't run here, so the true test is the first tagged build. Suggested order: merge this, then merge #10 and watch the release run.