feat: automate agentd releases

[haasonsaas]

Summary

• add Release Please manifest/config so version PRs update CHANGELOG.md, version.txt, .release-please-manifest.json, and both support/Info.plist version fields
• make package-release reusable so automated releases package the notarized Sparkle archive and upload agentd.zip, appcast.xml, checksums, and signing evidence to the GitHub release
• add CI guards for release metadata drift and PR titles that Release Please can parse
• document the automated release flow and the optional AGENTD_RELEASE_TOKEN secret for bot-created release PR CI

Test plan

• actionlint
• python3 scripts/validate_release_metadata.py
• python3 scripts/validate_pr_title.py 'feat: automate agentd releases'
• python3 scripts/validate_pr_title.py 'Fix capture recovery' fails as expected
• python3 scripts/sparkle_appcast.py self-test
• python3 scripts/mock_chronicle.py --self-test Tests/Fixtures/chronicle
• python3 scripts/macos_availability_audit.py
• swift build -Xswiftc -warnings-as-errors
• swift test
• xcrun swift-format lint --strict --recursive Sources Tests Package.swift
• scripts/package_app.sh
• Release Please dry-run in a disposable clone with a conventional test commit would open a 0.0.3 release PR and update CHANGELOG.md, version.txt, support/Info.plist, and .release-please-manifest.json

[cursor]

PR Summary

Medium Risk
Medium risk because it changes GitHub Actions permissions/secrets usage and automates release creation plus asset uploads, which can affect the integrity of published artifacts if misconfigured.

Overview
Adds an automated release lane using release-please on main to open/merge version PRs and, on release creation, trigger a reusable package-release workflow that builds, notarizes, generates Sparkle update metadata, and optionally uploads artifacts directly to the GitHub Release.

CI now enforces release hygiene by validating release metadata consistency (version.txt, .release-please-manifest.json, release-please-config.json, and support/Info.plist) and requiring PR titles to match a Conventional Commits pattern via new scripts. Documentation is updated to describe the automated flow, required secrets, and manual packaging options.

^{Reviewed by Cursor Bugbot for commit 5e0b4b4. Bugbot is set up for automated code reviews on this repo. Configure here.}