ci: manage IPFS release pin retention

[lthibault]

Summary

• add a VPS-side IPFS release publish helper that uses ipfs add --pin=false, explicitly pins the new release CID, publishes ww-release IPNS only after the pin succeeds, and retains the latest 10 CI-managed release CIDs
• prune only CIDs recorded in /data/ipfs/ww-release-pins.txt, run bounded best-effort ipfs repo gc after managed stale unpins, and report publish/retention/repo-stat details in the Actions summary
• update Makefile publish targets to avoid implicit Kubo pins and pin explicitly only for durable local publishes
• add static regression checks for the release publish script and workflow wiring

Validation

• bash tests/test_ipfs_release_publish.sh
• shellcheck scripts/ipfs_publish_release.sh tests/test_ipfs_release_publish.sh
• actionlint .github/workflows/rust.yml
• git diff --check

Migration note

The new CI state file intentionally does not claim ownership of existing production recursive pins. The current 142 legacy pins still need a one-time manual classification/cleanup; the first CI run with this change will create /data/ipfs/ww-release-pins.txt with the newly published CID and will not bulk-clean historical pins.