fix: release binaries from trusted main pushes - #426

Merged fork PRs currently fail both release build matrices at checkout before compilation: the pull_request_target event triggers checkout's fork protection even for the merged main commit (failed run 34681066279). A later PR without Rust changes can then carry old binaries forward because change detection only examines that last PR.

Run releases on trusted pushes to main, pin every checkout to the push SHA, and compare binary inputs against the commit of the last published release tag. This retains unreleased changes after failed runs and freezes the same tag for asset carry-forward. Recover new-feature labels from the matching merged PR to preserve minor/patch version behavior. Keep both architecture matrices, asset names/checksums, checkout protections, and write permission confined to the publication job.

Skip targets already covered by a published release; reject divergent history, changed baselines during partial reruns, and existing version tags at another commit. Recheck immediately before publication, with checkout preceding artifact downloads.

Validation:

• 38 tests execute the workflow's Bash against temporary Git histories and fake GitHub responses, including prior failed binary changes, direct pushes, feature labels, draft baselines, pagination, stale/equal targets, partial reruns, tag collisions, and API failures.
• make check: 2,190 passed, 2 skipped, 6 deselected. Ruff passed; the existing nonblocking ty step reported 9 diagnostics in unchanged source files.
• actionlint 1.7.12 passed (ShellCheck unavailable). pre-commit run --files .github/workflows/release.yaml tests/test_release_workflow.py passed. The required pre-commit run --all-files exposed existing errors outside this PR: 39 remaining Ruff findings after one automatic fix and 10 files reformatted. Those unrelated automatic edits were preserved in the session log and reverted; neither PR file needed changes.
• Read-only execution of the release decision against actual 4d3e8bd8 and release metadata selected v1.0.102 as the baseline, a Tachometer rebuild, and carry-forward of the unchanged CPU power exporter.

Release publication itself remains untested until this workflow reaches main; no Release rerun or publication was triggered for this PR.