ci: publish a draft github release with assets, add release conventions

[0xKT]

Summary

release.yml only uploaded the built wheel to Actions artifacts, so a pushed tag never produced a downloadable Release asset. install.sh resolves the wheel from the latest Release asset, so a tag silently kept serving the old version until someone manually created the Release and attached the wheel. This builds a draft Release with the wheel and sdist attached (cutting a release becomes one review plus a Publish click), and documents the conventions in RELEASING.md.

• release.yml: on a version tag, create a draft GitHub Release with the wheel + sdist attached, a dated title, and notes prefilled from a template. Idempotent re-runs (list endpoint + delete a stale draft, keeping the tag); prerelease tags (vX.Y.Z-rcN) stay out of /releases/latest; the tag is guarded against the pyproject version; adds concurrency and aligns action versions with ci/commits.
• RELEASING.md + .github/release-notes-template.md: the release conventions and the CI notes skeleton.

Publishing stays a deliberate human step -- CI only creates the draft.

Type

• CI / tooling

Verification

Local (macOS):

• actionlint (with shellcheck on the run blocks) clean on release.yml.

• YAML parses; the version/prerelease shell logic and template substitution run correctly against the real pyproject and tag values.

• Idempotency detection verified against the live releases API (published tag -> left alone; missing tag -> create).

• Not yet run end to end on a GitHub runner. Before the first stable release, a vX.Y.Z-rc1 tag will dry-run the full draft/attach/idempotency path -- a prerelease never becomes /releases/latest, so users are unaffected.

• Relevant tests pass locally

• Relevant lint / type checks pass locally

• User-facing docs or screenshots are updated when needed

Risk

• Security impact considered
• Backward compatibility considered
• Rollback path is clear for risky changes

The job gets contents: write (needed to create the Release). No behavior change until a version tag is pushed; the workflow is dormant otherwise. Rollback: revert the commit.

Related Issues

N/A