feat(release): publish zunit binaries from tags

[ss-o]

Summary

• add a semantic-tag GitHub release workflow for the built zunit executable
• add a small release-tag guard that fails if the tag version and zunit --version diverge
• include release regression tests and extend Zsh syntax checks to cover release helper scripts

Release model

This keeps main as validation-only. User-facing binaries are published only when a maintainer pushes a semantic tag such as v0.8.2.

The release asset is named zunit, matching the existing generated consumer workflow download shape.

Closes #4.

Verification

• RED: PATH="$tmpbin:$PATH" ./zunit --tap tests/release.zunit failed before the release helper/workflow existed
• PATH="$tmpbin:$PATH" ./zunit --tap tests → 112/112 passing
• scripts/verify-release-tag.zsh v0.8.2 ./zunit
• find src scripts -type f -name '*.zsh' -print | sort | while read -r file; do zsh -n "$file" || exit 1; done
• zsh -n build.zsh
• zsh -n zunit.zsh-completion
• git diff --check
• ruby -e 'require "yaml"; ARGV.each { |f| YAML.load_file(f); puts "ok #{f}" }' .github/workflows/release.yml .github/workflows/zsh-n.yml