feat(ci): auto-create the GitHub Release on tag push

[Chouffe]

Summary

• Adds a release job to push.yml that auto-creates the GitHub Release on every vX.Y.Z tag push, so maintainers no longer write release notes by hand.
• The Release body is a small header (Docker image: + Bundled model:) followed by GitHub's auto-generated "What's Changed" (--generate-notes).
• Logic lives in scripts/create-github-release.sh (mirrors scripts/release-api.sh) with a stub-gh contract test; the job just calls it.
• Adds docs/releasing.md runbook covering the full flow and the two decoupled version axes (code tag vs api/MODEL_VERSION).

Design

release needs: docker, so a Release is never created if the image build/push fails. Permissions are least-privilege: top-level contents: read, release overrides to contents: write. gh release create fails if the Release already exists — no silent overwrite.

Spec: docs/specs/2026-06-11-github-release-automation-design.md

Test Plan

• bash scripts/test-create-github-release.sh → PASS (asserts header content + exact gh release create args; covers empty-MODEL_VERSION abort)
• Workflow YAML + job graph validated (needs: docker, contents: write, GH_TOKEN wired)
• Script is 100755 in git; header renders with literal backticks + correct expansion
• Live integration (Release + "What's Changed" actually created) — confirmed on the next real vX.Y.Z tag