[codex] add codestory auto release

[TheGreenCedar]

What changed

• Added auto-release and reusable release workflows for CodeStory version bumps on main.
• Added release helper scripts for workflow policy, Cargo/Cargo.lock version sync, and cross-platform CLI packaging.
• Added root changelog and release guidance in AGENTS.md and docs/contributors/testing-matrix.md.
• Updated retrieval-sidecar-smoke to satisfy the new third-party action pinning policy.
• Logged the required CodeStory repo-scale e2e stats row for this working tree.

Why it changed

Future synchronized CodeStory workspace version bumps should create GitHub releases automatically, with GitHub-hosted CLI binary assets and SHA256SUMS.txt, without manual tag pushes.

How I verified

• node .github/scripts/check-workflow-policy.mjs
• python .github/scripts/check-codestory-release.py --version 0.7.0
• python -m py_compile .github/scripts/check-codestory-release.py .github/scripts/package-codestory-release.py
• cargo fmt --check
• cargo check --workspace --all-targets
• cargo test -p codestory-cli --test cli_error_contracts
• cargo test -p codestory-cli --test stdio_protocol_contracts
• cargo build --release -p codestory-cli
• .\target\release\codestory-cli.exe --version
• .\target\release\codestory-cli.exe --help
• python .github/scripts/package-codestory-release.py --version 0.7.0 --target windows-x64 --binary target/release/codestory-cli.exe --out-dir target/release-smoke
• verified the local Windows archive checksum and expected archive contents
• CODESTORY_ALLOW_SKIP_REAL_REPO_DRILL_CASES=1 cargo test -p codestory-cli --test codestory_repo_e2e_stats -- --ignored --nocapture
• git diff --check / git diff --cached --check

Remaining risk or follow-up

• I did not publish a release or push tags manually.
• actionlint is not installed locally, so workflow syntax is covered by readback and helper checks, not actionlint.
• The repo-scale e2e reached proof_tier full_sidecar with no warnings; the separate real-repo drill was intentionally skipped because CODESTORY_REAL_REPO_DRILL_CASES was not set.