M11.5a: create GitHub Release after qualified publish

[pgousdal]

Fixes the post-release audit dependency discovered by v0.2.0.

Changes:

• grant contents: write to the Release workflow
• create the GitHub Release only after exact-digest runtime qualification, provenance attestation, Cosign signing, and signature verification succeed
• keep the step idempotent if the GitHub Release already exists

This ensures future successful tag releases automatically satisfy the M11.5 post-release audit prerequisite.