[codex] align release publishing with ghost

[nahiyankhan]

Summary

• Changes the main-branch release workflow into a version-PR-only workflow so merges to main no longer publish packages.
• Adds an explicit Ghost-style tarball release workflow triggered by anarchitecture-madrigal@<version> tags or manual dispatch.
• Updates release docs and the local release script to describe and perform packing instead of npm publishing.

Why

Madrigal's release workflow was passing a raw npm publish command to changesets/action, which made ordinary main-branch runs eligible to attempt publishing. This aligns Madrigal with Ghost's explicit release channel: versioning on main, publishing only from an intentional release trigger.

Validation

• Parsed .github/workflows/release.yml and .github/workflows/release-tarball.yml with the repo's YAML parser.
• git diff --check
• pnpm exec biome check package.json
• pnpm build
• Pre-commit: pnpm biome check .
• Pre-push: pnpm vitest run, pnpm biome check ., pnpm tsc --noEmit