[lmcorbalan]

Summary

Closes #145

There is no way to depend on this repository without cloning it and building, which drags the whole Splice vendoring flow downstream. This adds the workflow that publishes the built DAR as a release asset on a v* tag push.

Changes

• New .github/workflows/release.yml: asserts the pins, builds, proves the DAR byte-reproducible, runs the consumer smoke test, publishes with a generated body.
• workflow_dispatch runs every check and cannot publish, because the gate is the event, not an input.
• contents: write is confined to this workflow, and the checkout does not persist its token.

Acceptance criteria

• All eight from the issue are met.

Test plan

Automated tests

None; a workflow cannot be exercised until a tag exists.

Manual verification

Ran the workflow's step order locally: npm test 80 ok, DAR reproducible at 147835e7, smoke green, tree clean. Extracted each step and ran it: the pin sweep names all three tracked manifests, and a manifest missing --target=2.1 fails naming it. A gh shim confirms v0.0.1-rc1 publishes as a pre-release and v0.1.0 does not.

Breaking changes

None. Nothing runs until a v* tag is pushed, and the rehearsal in #133 exercises the publish path on a throwaway tag first.

Checklist

• Self-reviewed my own diff
• Tests added or updated
• Docs updated (if applicable)
• No unrelated changes bundled in

Screenshots

None.