ci: build, sign and release ROneCOne.cls from a pushed tag

[WilliamSmithEdward]

Releases are now built, scanned, signed and created in CI from a pushed vX.Y.Z tag, by a new .github/workflows/publish.yml. The old flow (files built locally, release created by hand, then release-security.yml on release: published) is removed.

What Publish does

• Build the release files (build): on a tag, refuses a tag that is not the version in the release header of src/ROneCOne.cls. Runs tools/stamp_release_headers.py and git diff --exit-code, so the committed modules are exactly what the stamp produces from CHANGELOG.md and LICENSE. Fails if docs/releases/vX.Y.Z.md is missing. Writes ROneCOne.cls and vX.Y.Z-sha256.txt, and fails if a committed docs/releases/vX.Y.Z-sha256.txt disagrees.
• Security and Malware scan: the existing workflows, now callable with workflow_call.
• Write the security report: tools/security_scan.py --report over the built ROneCOne.cls, as vX.Y.Z-security-report.md. Same tool, title and file name as before.
• Attest the release files (tag runs only): actions/attest on ROneCOne.cls and vX.Y.Z-sha256.txt, bundle kept as provenance.
• Create GitHub release: attaches ROneCOne.cls, vX.Y.Z-sha256.txt, vX.Y.Z-security-report.md and ROneCOne-X.Y.Z.sigstore.json, with docs/releases/vX.Y.Z.md as the notes and the tag as the title. Started by hand it is a dry run and uploads release-preview instead.

Line endings

Git stores src/ROneCOne.cls with LF (* text=auto). Every release so far shipped it with CRLF, as a Windows checkout writes it. The build converts LF to CRLF and nothing else. Checked: the CRLF form of v1.10.3:src/ROneCOne.cls has SHA-256 938835...092b, the hash in the v1.10.3 release's v1.10.3-sha256.txt.

Other changes

• security.yml and malware-scan.yml: workflow_call trigger. Their concurrency group now includes the event, so a dry run on main and a push run on main do not cancel each other.
• .github/zizmor.yml: turns off self-repository and superfluous-actions, with the same reasons as xlide_vscode. Nothing else is silenced.
• AGENTS.md: the standard "How a release happens here" line, and a short release procedure.
• SECURITY.md: the Releases and Verifying sections describe Publish and gh attestation verify. The Scorecard bullet no longer says releases carry no provenance.
• README and user guide: demo workbooks come from demo/, not the release. docs/development.md, docs/README.md and CHANGELOG updated.

Validation

• python -m unittest discover -s tests/python: 102 tests, OK (3 skipped).
• zizmor over .github/workflows: no findings.
• repo-standards workflow and AGENTS checks: clean.
• tools/security_scan.py --report over the CRLF ROneCOne.cls alone: writes the report, matches the baseline.

A dry run of Publish is not possible before this merges, because workflow_dispatch needs the file on main. After merging: gh workflow run publish.yml --ref main, then gh run download <run-id> -n release-preview.