Add release script and workflow to check release versions

[sirbrillig]

Why

The 3.0.2 version bump commit was tagged and released, but it was never merged into trunk, so trunk still reported 3.0.1. This adds a check before releasing and a backstop check afterward so that can't happen unnoticed again.

What

• release.sh <version> (--dry-run runs only the checks). It refuses to release unless:

  • you're on trunk with no uncommitted changes to tracked files
  • local trunk matches origin/trunk, so the release commit is already on the remote
  • getVersion() in PhpcsChanged/functions.php returns exactly <version>
  • v<version> doesn't already exist and is higher than the latest release tag

  It then runs gh release create v<version> --target <origin/trunk sha> --generate-notes, which creates a lightweight tag and generated release notes, like past releases.

• Release check workflow (.github/workflows/release-check.yml). It runs on v* tag pushes and on published releases, and fails if the tagged commit isn't on trunk or if its getVersion() doesn't match the tag. It can't block a release, but it flags releases made by hand.

• README: a new "Releasing" section at the bottom documents the process, including when to use a minor or a patch bump.

Testing

• Ran ./release.sh --dry-run against a clean trunk:
  • 3.1.0 passes all checks
  • 3.2.0, 3.0.2 and 3.0.9 fail the getVersion() check
  • 3.1 fails the version format check
  • an unpushed local commit fails the origin/trunk check
  • a dirty tree fails the uncommitted-changes check
• Ran it against temporary local tags (deleted afterward): an existing v3.1.0 fails the tag-exists check, and a v3.5.0 fails the higher-than-latest-tag check.
• Ran the workflow's logic by hand. v3.0.2 fails the on-trunk check, which it would have caught. v3.0.1 passes both checks.
• The workflow itself will first run on the next release tag.