Build the Stage-2 release workflow: one-click store release via environment-scoped CI secrets

[rosscado]

Problem: Stage 2 of the accepted release-delegation criteria (doc/release/delegation-criteria.md, founder-accepted 2026-07-07 on PR #538) needs its machinery built: today's founder-run bump/build/tag/finalize/submit become a GitHub Actions workflow whose secrets live on a protected store-release environment (required reviewer = founder, deployments restricted to main), so one founder click replaces five founder-run commands and the credentials boundary strengthens (secrets leave the laptop for CI storage the agent structurally cannot read).

Scope: the release workflow + environment setup + a dry-run job (build + release:verify, no submit). Out of scope: enabling Stage 3 (separate bar), any change to what agents may run locally.

Reproduction / verification: no release workflow exists in .github/workflows/. Verify done = a dry-run produces artifacts content-equivalent to a founder-local build (per-file hashes of unpacked artifacts, per the criteria doc) and release:verify passes in-workflow.

Acceptance criteria:

• Workflow implemented per the criteria doc: environment-scoped secrets only (never repo-level), store-release environment with required-reviewer protection + main-only deployments, dispatch-able after Stage-1 packet prep.
• The content-equivalence dry-run executed once and recorded.
• Founder sign-off on the workflow itself before it ever holds secrets (it is store-submission plumbing — founder-gated; also flagged by path-guard).
• Stage 2 activation still requires the rest of its bar: 3 zero-correction packets + secret-scan promoted to required (Promote path-guard and secret-scan to required branch-protection checks (evidence bar) #554).

Notes (non-binding): secrets migration into the GitHub environment is a founder-only act (credentials boundary); the agent builds the workflow shell + dry-run with no secrets present.