ci: use release asset fallbacks without zstd

[cbusillo]

Summary

• stop requiring privileged zstd installation in the self-hosted publish job
• when zstd is unavailable, remove .zst release assets that have matching .tar.gz fallbacks so package assembly and changelog extraction use tar instead
• keep a clear failure if a .zst artifact has no fallback

Validation

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release.yml"); puts "yaml ok"'\n- git diff --check\n- ./build-fast.sh\n\nRefs Fix release preflight runner capabilities #108\nRefs Plan Every Code default branch and release identity #87