ci: add versioned action release workflow

[vitormattos]

Summary

Add a reproducible release process for the reusable governance actions.

The manual release workflow:

• only releases from main;
• requires an explicit vMAJOR.MINOR.PATCH input;
• verifies the requested version matches package.json;
• refuses to overwrite an existing tag;
• runs the full project checks again before publication;
• creates the Git tag and GitHub Release at the exact validated commit.

This provides the release mechanism needed for #13 while consumers remain pinned to immutable commit SHAs.