CI: a tag push builds, tests and publishes the release

The artifacts and the GitHub release were made by hand (`python -m build` plus
`gh release create`).  `.github/workflows/release.yml` now does it from the
pushed tag: Python and PWA tests, the sdist/wheel build, a check that the
wheel carries the PWA, an install-and-serve smoke test of that wheel, and
`gh release create` with the generated notes (prepended by
`.github/release-notes.md`) and the three assets (wheel, sdist, udev rule).

A `workflow_dispatch` run does everything except publish, so the pipeline can
be exercised without minting a release; the artifacts land in the run.  A tag
that does not match version.py/PWA_VERSION fails before anything is published.

.github/release-notes.md

@@ -0,0 +1,14 @@
+Install the wheel below — the PWA is bundled inside it:
+
+```
+pip install ./simtrace_analyser-*.whl
+simtrace-analyser-server --capture gsmtap
+```
+
+The UI is then served at http://127.0.0.1:8081/.  If your system Python is
+externally managed (PEP 668 — common on Arch and Fedora), install into a
+virtual environment first (`python3 -m venv .venv && . .venv/bin/activate`).
+
+The source archive is the same tree a clone would have: unzip it and run
+`./start.sh` (Linux/macOS) or `start.bat` (Windows).  Direct SIMtrace2 capture
+on Linux additionally needs the attached `70-simtrace2-pysniff.rules` udev rule.