Add release tags and CI release artifacts

[3esmit]

Summary

Add release tagging and release artifact publishing for lez-programs.

This repo should use the same repo-level release tag style as
logos-execution-zone: vX.Y.Z for stable releases and vX.Y.Z-rcN for
release candidates. When such a tag is pushed, GitHub Actions should build the
guest program binaries and upload a release bundle containing deployable
artifacts.

Investigation

• logos-blockchain/logos-execution-zone uses repo-level tags such as
  v0.2.0-rc6 and v0.1.2. Its publish_images.yml runs on tag pushes
  matching v*.
• logos-blockchain/logos-blockchain has a release checklist flow and a
  prepare-release.yml workflow that builds release binaries, uploads them as
  workflow artifacts, then attaches them to a draft GitHub release.
• logos-co/logos-modules-release and logos-co/logos-modules-v2 use a
  catalog flow for modules. Tags are <module>-v<version>, and releases carry
  .lgx plus sidecar.json assets. That is useful as a reference for artifact
  publishing, but it is not the right tag shape for this standalone program
  repository.
• logos-co/spel also uses vX.Y.Z tags, with release candidate tags using an
  -rc suffix.

Proposed implementation

1. Add .github/workflows/release.yml.

2. Trigger it on:

   on:
     push:
       tags:
         - "v*"

3. Reject tags that do not match:

   ^v[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?$
   

4. Mark the GitHub release as a prerelease when the tag contains -rc.

5. Reuse the existing RISC Zero install action.

6. Build every guest program from the release tag:

   cargo risczero build --manifest-path programs/token/methods/guest/Cargo.toml
   cargo risczero build --manifest-path programs/amm/methods/guest/Cargo.toml
   cargo risczero build --manifest-path programs/ata/methods/guest/Cargo.toml
   cargo risczero build --manifest-path programs/stablecoin/methods/guest/Cargo.toml
   cargo risczero build --manifest-path programs/twap_oracle/methods/guest/Cargo.toml

7. Regenerate and check IDL files with the same logic used by CI.

8. Build a release directory with:

   bin/token.bin
   bin/amm.bin
   bin/ata.bin
   bin/stablecoin.bin
   bin/twap_oracle.bin
   idl/token-idl.json
   idl/amm-idl.json
   idl/ata-idl.json
   idl/stablecoin-idl.json
   idl/twap_oracle-idl.json
   program-ids.txt
   SHA256SUMS
   

9. Fill program-ids.txt from spel inspect <binary>.

10. Upload lez-programs-${TAG}.tar.gz as a workflow artifact.

11. Attach lez-programs-${TAG}.tar.gz and SHA256SUMS to the GitHub release,
    using softprops/action-gh-release@v2 or the equivalent gh release
    command.

Acceptance criteria

• Pushing vX.Y.Z creates a non-prerelease GitHub release.
• Pushing vX.Y.Z-rcN creates a prerelease GitHub release.
• Invalid tag names fail before building artifacts.
• Release artifacts include all five deployable guest binaries, all five IDL
  JSON files, inspected program IDs, and checksums.
• The release workflow fails if any guest binary or IDL file is missing.
• The existing CI validation still passes on the tagged commit before release
  artifacts are published.