Publish unsigned releases from release branches

[fastducduc]

Pushes to top-level *-release branches now build unsigned Intel nvALT and publish its ZIP as a GitHub Release. The existing Release and Development build checks still run.

The release job runs after the build and artifact checks pass. It uses release-<run number>-<attempt> at the built commit, uploads the ZIP into a draft, then publishes it. Existing tags never move. Releases record the branch, commit, and build log without replacing the explicit Latest selection. The built-in GitHub token needs no additional secrets.

Validation on commit b0f7395dc0b0ffd683136a39adec25db08b6ee27:

• 35 CI unit tests and actionlint 1.7.12 passed locally on macOS 26.5.2.
• Upstream PR CI passed, including both app configurations with Xcode 16.4 on macos-15-intel. The tag and release jobs correctly skipped the pull request.
• Both live branch tests published releases. Each release tag targets the built commit, and each ZIP SHA-256 digest matches its CI artifact.
• The downloaded release passed archive, app identity, and Intel architecture checks. codesign reports that the app is not signed.

Test branch in fastducduc/nv	Result
ci-smoke-20260911-a-release	Build passed, release with ZIP
ci-smoke-20260911-b-release	Build passed, release with ZIP
ci-smoke-20260911-release-candidate	No push workflow run
codex/ci-smoke-20260911-release	No push workflow run

Live publication tests ran in the fork because the current API token has push access there. After merge, matching branches in dangduc/nv will publish to its Releases page. Branch protection remains a separate configuration.