fix(release): support SemVer build metadata

[blurbery]

Summary

• Accept optional SemVer build metadata such as +build.7.
• Determine prerelease status from the version before build metadata, so a hyphen inside build metadata does not create a false prerelease.
• Document build-metadata examples and the existing GitHub write-access boundary.
• Explain when maintainers should add a protected release environment with required reviewers.

Review provenance

This directly addresses CodeRabbit's actionable correctness finding and access-boundary note on upstream PR #678.

Validation

• Official checksum-verified actionlint 1.7.12: all workflows pass.
• SemVer/prerelease matrix: 24 valid, invalid, and coherence cases pass.
• Workflow and release-note YAML parse successfully.
• make verify-local-paths passes.
• git diff --check passes.
• GitHub's official documentation confirms that manually dispatching a workflow requires repository write access.

Ownership

All work in this pull request is owned and submitted by @blurbery. Product direction, scope, and acceptance decisions are theirs.

AI Disclosure

• Tool(s): OpenAI Codex desktop
• Model(s): GPT-5.6 Sol
• Involvement: AI-assisted review triage, implementation, and validation under @blurbery's direction
• Adversarial review: The CodeRabbit finding was independently reproduced before editing. The fix preserves strict SemVer numeric rules, adds only the build-metadata grammar SemVer permits, and tests hyphenated metadata separately from prerelease state.