feat(release): automate approved milestone publication

[ss-o]

Description

Automate the approved Zi milestone release flow without automating tag creation:

• call the organization semantic-version and release-notes preparation workflow after a promotion reaches main
• require a maintainer-pushed signed annotated vX.Y.Z tag as publication authorization
• reject malformed, lightweight, unverified, stale/off-main, target-mismatched, or insufficiently tested tags
• publish generated GitHub release notes idempotently after verification

The reusable caller is pinned to the exact merged policy commit. No version file or release dependency is added. This becomes active when next is next promoted to main.

Related issues

Part of #468
Policy: z-shell/.github#583 and z-shell/.github#584

Type of change

• feat - new feature (non-breaking)
• ci - CI/workflow change

Validation

• actionlint on both workflows
• Ruby YAML parse with aliases enabled
• zsh -n on the verifier and focused test
• zsh -f tests/release-tag-verification.zsh
• safe Trunk check on all four files
• live read-only verification of signed tag v2.0.0 against its exact main commit and successful workflows
• git diff --check

Checklist

• Ordinary work targets next; only same-repository hotfixes target main
• Commit messages follow Conventional Commits format
• No prohibited Co-authored-by trailer is present
• Contribution guidelines reviewed
• Relevant tests pass
• Release policy documentation was updated in feat(release): allow approval-gated Zi automation .github#584

Migration plan

Not required. This does not change Zi's public shell contract.