Add multi-platform release automation

[LunaStev]

Summary

• add a tag/manual-dispatch release workflow for all six documented Vex targets
• aggregate the complete artifact set, generate one SHA256SUMS, and attest the archives and checksum
• create a Draft GitHub Release only after every target succeeds
• add maintainer release instructions and complete the Makefile-to-x.py transition

Why

Vex already had reproducible per-target packaging, but it did not have a safe multi-platform release pipeline. Maintainers had no automated gate proving that every expected archive existed before a release was assembled, and the legacy Makefile duplicated an incomplete Linux-only packaging path.

Behavior

• v* tag pushes and manual runs for an existing annotated tag validate that the tag matches the version in Cargo.toml.
• Linux amd64/arm64, Windows x64, and both macOS architectures build and smoke-test native archives. Linux RISC-V cross-builds and runs its smoke test under QEMU.
• A failed or partial matrix cannot create a GitHub Release.
• The final job rejects missing or unexpected archives, writes the combined checksum manifest, generates GitHub build-provenance attestations, and creates an unpublished Draft Release.
• python3 x.py checksum [TARGET...] validates an assembled archive set. python3 x.py verify-release enforces a clean tree and annotated version tag.
• The legacy Makefile is removed; x.py is now the sole supported release entry point.

Validation

• python3 x.py check
• python3 x.py build x86_64-unknown-linux-gnu
• python3 x.py package x86_64-unknown-linux-gnu
• python3 x.py checksum x86_64-unknown-linux-gnu
• sha256sum --check SHA256SUMS from dist/
• release archive vex --version and vex --help smoke tests
• release and CI workflows parsed as YAML
• actionlint v1.7.12 .github/workflows/ci.yml .github/workflows/release.yml
• git diff --check