ci(release): publish reviewed promotions automatically

[ss-o]

Summary

• replace the post-merge proposal issue with a deterministic release plan on eligible promotion pull requests
• verify the exact promotion merge and all four required workflow runs before publication
• create the annotated tag and idempotent GitHub release in the same privileged workflow
• preserve the signed manual tag path for recovery
• run Zsh and ZD validation on every persistent-branch push so exact-SHA evidence always exists
• cover semantic versioning, persistent-branch topology, workflow qualification, main movement, tag conflicts, and retry idempotence

Release behavior

The current candidate resolves from v2.2.0 to v2.2.1. The releasable range contains fix(load) and perf(bench); this automation commit is ci(release) and does not change the bump.

Validation

• Zsh syntax for all new scripts and tests
• zsh -f tests/release-plan.zsh
• zsh -f tests/promotion-release-verification.zsh
• zsh -f tests/promotion-release-publication.zsh
• zsh -f tests/release-tag-verification.zsh
• zsh -f tests/ci-registration.zsh
• Trunk on all 14 changed files
• git diff --check

Closes #564.

Parent: z-shell/.github#644