ci: auto-publish release after build + document version bump flow

[rrbe]

What

1. Auto-publish releases from CI (release.yml) — adds a publish job that flips the draft to a published release once all three platform builds succeed. No human step.
2. Documents the version bump → release flow in CLAUDE.md.

Why auto-publish this way (not just releaseDraft: false)

The matrix build stays releaseDraft: true so assets accumulate in a private draft. A separate publish job (needs: build) publishes it only after every platform passes:

• Naively setting releaseDraft: false would expose a half-uploaded release while builds are still running, and would publish a partial release if one platform fails.
• With needs: build, a failed platform leaves the release as a draft (safe) — nothing half-baked goes public.

Background

• v0.12.0 / v0.12.1 release builds had failed with failed to decode secret key: incorrect updater private key password (Tauri updater signing key). Already fixed by chore: remove tauri updater plugin #29 (updater plugin removed); docs warn against re-adding it.
• v0.13.0 was bumped (chore: bump version to 0.13.0 #32) but never tagged, so it never released. Tagged & pushed as part of this work (that build ran against the old workflow, so it lands as a draft and is published manually once; future releases auto-publish).