Auto-create GitHub Release on tag push

The publish.yml workflow previously only published to PyPI on `v*` tag
push; the GitHub Releases page stayed empty across all prior versions
(0.1.0 → 0.5.0; backfilled by hand). Adds a `release` job that runs
after `publish` succeeds, extracts the matching `## [VERSION]` section
from CHANGELOG.md via awk, and creates a GitHub Release with that body
(falling back to the annotated-tag message if no CHANGELOG section
exists). Requires bumping permissions to `contents: write`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dcj

.github/workflows/publish.yml

@@ -7,7 +7,7 @@ on:
 
 permissions:
   id-token: write
-  contents: read
+  contents: write
 
 jobs:
   test:
@@ -34,3 +34,31 @@ jobs:
       - uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
         with:
           print-hash: true
+
+  release:
+    needs: publish
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          # Extract the [VERSION] section from CHANGELOG.md (between this
+          # version's heading and the next "## [" heading).
+          if [ -f CHANGELOG.md ]; then
+            awk -v ver="## [${version}]" '
+              index($0, ver) == 1 { in_section=1; next }
+              in_section && /^## \[/ { exit }
+              in_section { print }
+            ' CHANGELOG.md > /tmp/release_body.md
+          fi
+          # Fall back to the annotated-tag message if CHANGELOG was empty.
+          if [ ! -s /tmp/release_body.md ]; then
+            git tag -l --format='%(contents)' "${GITHUB_REF_NAME}" > /tmp/release_body.md
+          fi
+          gh release create "${GITHUB_REF_NAME}" \
+            --repo "${{ github.repository }}" \
+            --title "${GITHUB_REF_NAME}" \
+            --notes-file /tmp/release_body.md