feat(release): say plainly which file to download, one version per page

[QuicksilverSlick]

What this is

The release page read as a file list for developers. It now tells a visitor which single file is theirs.

• scripts/dreamforge-release-notes.md: the page text. It opens with a table (Windows PC, Mac with an Apple chip, Mac with an Intel chip), where each row links its exact file. Then it explains how to tell which Mac you have, gives numbered install steps for Windows and Mac, and says which files to ignore (.app.tar.gz, .sig, latest.json, and GitHub's "Source code").
• Publish job, "Upload to the rolling release":
  • fills {VERSION} and {BASE} into the template and refuses to continue if a placeholder is left;
  • titles the release Dreamforge <version> and rewrites the notes on every publish, not only the first;
  • after latest.json is uploaded, deletes assets from earlier versions, so the page shows one set. latest.json no longer names those files. A failure there only warns, because the release is already live by then and a rerun would be refused as "not newer". The notes edit runs before latest.json, for the same reason.
  • the pre-publish existence check now also covers both DMGs, because the page links them directly.

VERSION is already plain x.y.z at that point, because "Write latest.json" refuses anything else. So the sed input can't carry anything unexpected.

Review

Two reviewers checked this PR, one for publish-step correctness and one for install-step accuracy against Apple and Microsoft documentation. All six findings were applied in the second commit:

• the ordering and warn-only cleanup above;
• no pipefail in the publish job's bash, so the asset list is captured without a pipe;
• the DMG existence check;
• Mac steps: click Done, not Move to Trash, Open Anyway lasts about an hour, and it asks for the login password;
• chip guidance for A-series Macs;
• Edge's "isn't commonly downloaded" prompt and Smart App Control.

Verified

• The template rendered for 0.5.21 has no placeholders left, and all three links return 200 against the live release.
• The cleanup rule, dry-run for 0.5.22 against current, old and look-alike names (0.5.220), keeps latest.json and the _0.5.22_ files and deletes the rest.
• The workflow YAML parses. The step body was run under bash -e with a fake gh whose asset listing, and separately one delete, fails. Both runs finish 0 and print the warning.
• The same text is already on the live 0.5.21 release (title "Dreamforge 0.5.21"), applied by hand with gh release edit.

🤖 Generated with Claude Code