release: tag + binary distribution workflow for v0.1.0

[amondnet]

Context

The repository has never cut a release: no git tags, no GitHub releases, and no publish workflow
(.github/workflows/ holds only ci, codspeed, deploy-web, deploy-wiki). The Cargo
workspace is at 0.1.0 and LICENSE (Apache-2.0) landed in #48, so the remaining gap is purely
the release mechanics — a user cannot install honmoon today without building from source.

Tasks

• Tag-triggered release workflow (on: push: tags: v*) cutting a GitHub Release with notes
• Cross-compiled honmoon binaries as release assets — at minimum linux-x86_64, linux-aarch64, macOS arm64 (the dashboard is embedded via rust-embed, so the dashboard build must run first)
• Decide the npm story for @honmoon/cli / @honmoon/policy: publish or keep internal. If published, use npm publish --provenance with permissions: id-token: write (bun publish does not support provenance) — build the tarball with bun pm pack
• Decide whether the Rust crates go to crates.io or stay repo-only for v0.1.0
• Version-bump path: single source in the workspace Cargo.toml + the Bun workspace packages, kept in sync
• Install instructions in README.md pointing at the release assets
• Pin the new workflow's actions to full SHAs (see the TD-005 issue)

Effort: M — mostly wiring, but the cross-compile matrix and the embedded-dashboard build order need care.