chore: release workflow (tag-triggered, SBOM, GH Release publish)

[constk]

Problem

Releases need reproducible artefacts (image, SBOM) and a published GitHub Release derived from the draft.

Proposed solution

Port .github/workflows/release.yml: tag pattern v*.*.*. Steps: Docker build with version tag and latest, CycloneDX SBOM via uvx --from cyclonedx-bom==7.3.0, GitHub Release publish (promote draft or create with auto-generated notes), attach sbom.json. Permissions: contents: write, packages: write. Pin all action SHAs.

Acceptance criteria

• Pushing a v0.1.0 tag triggers the workflow.
• Image ghcr.io/constk/harness-python-react:0.1.0 and :latest published.
• sbom.json attached to the release.
• Draft release promoted to published; notes match release-drafter content.

Priority rationale

Medium: only fires at release time; safe to land later. But the SBOM story is a strong portfolio detail.

Depends on

#6, #12

[constk]

Merged via #53. Tag-triggered release workflow with image push to GHCR + SBOM + GitHub Release publish.