Add protected GitHub release automation

[kwatson]

Summary

• add a strict CHANGELOG.md-driven vX.Y.Z release contract
• build the OpenClaw plugin, Thunderbird XPI, and Mozilla reviewer source once
• qualify the exact candidate bytes across Linux and Windows, with native Apple Silicon filesystem/security coverage
• reproduce the XPI from the submitted reviewer source and scan unpacked release contents
• require approval through the protected release environment before creating the GitHub release

Publication boundary

This creates GitHub releases only. It does not publish to ClawHub or Thunderbird Add-ons; the first marketplace submissions remain manual and must use the attached exact bytes.

Verification

• mise exec -- npm test (320/320)
• mise exec -- npm run typecheck
• mise exec -- npm run pack:release
• source archive clean rebuild/content comparison
• checksum-pinned Gitleaks scan of unpacked artifacts