ci: release workflow for tagged builds

[tamnd]

Summary

Adds a tag-triggered release workflow so I can cut Vietnamese releases without hand-building artifacts. Triggered by pushing a tag matching v*-vi.* (e.g. v3.3.2-vi.1); also runnable via workflow_dispatch for re-runs.

Tag scheme

v<UPSTREAM_VERSION>-vi.<N> — the first Vietnamese release on upstream v3.3.2 is v3.3.2-vi.1. Translation fixes against the same upstream bump N; an upstream version bump resets N to 1. UPSTREAM.md pins the exact upstream commit (9fb2a78e12e71e1c38c4e6b6a2da2260f00ec5d2) so release notes can link back to beejjorgensen/bgnet at the right point.

What the workflow does

1. Checks out at the tag, reads upstream version/commit from UPSTREAM.md.
2. Builds the bgnet-vi-build image via buildx with type=gha cache (same pattern as the pages deploy — first run is cold, subsequent runs warm).
3. Runs scripts/build_vi.sh inside the container to produce docs/.
4. Packages release assets: 8 PDFs, bgnet.epub, bgnet_html.zip + bgnet_html_wide.zip, bgnet_source.zip, and a full-site tarball for mirroring.
5. Generates release notes that reference the upstream commit and then softprops/action-gh-release@v2 publishes them.

scripts/release.sh

Local helper so I don't have to look up the next -vi.N each time. Parses src/Makefile VERSION_DATE for the upstream version, scans existing tags for the highest -vi.N, prompts before tagging, and optionally pushes with --push.

./scripts/release.sh                 # inspect, confirm, tag locally
./scripts/release.sh --push          # also push (triggers release CI)
./scripts/release.sh --revision 3    # force specific vi.N
./scripts/release.sh --tag v3.3.2-vi.1

Test plan

• Merge this PR.
• Cut v3.3.2-vi.1 via ./scripts/release.sh --push on main.
• Verify release workflow green and GitHub release shows all expected artifacts (8 PDFs, epub, two html zips, source zip, site tarball).
• Confirm release notes link back to beejjorgensen/bgnet@9fb2a78e.