build(ci): real release finalizer + make release target (T-393)

ci/release.sh was a stub that printed a goreleaser/sidecar TODO and
exited 64 — both the sidecar and goreleaser are dissolved (D-56), so it
could never run. Replace it with a finalizer for the single-process app:
read the version from pubspec, assert CHANGELOG has a dated section for it
and the tree is clean, run the full gate (make push-check), then create
the annotated vX.Y.Z tag if missing. Never pushes — prints the
--follow-tags push + build commands. Add a `make release` wrapper so it's
driven through the Makefile like the other gates (CLAUDE.md tooling rule).

This closes the loop that left releases untagged: running `make release`
after the release commit can no longer forget the tag.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Makefile

@@ -186,6 +186,10 @@ build-macos: gen-build-info ## flutter build macos (desktop bundle).
 build-windows: gen-build-info ## flutter build windows (desktop bundle).
 	flutter build windows
 
+.PHONY: release
+release: ## Finalize a release: verify version/changelog/tree, run the gate, tag vX.Y.Z. Run after the `release vX.Y.Z` commit.
+	ci/release.sh
+
 # -- install / uninstall -----------------------------------------------------
 
 # Install prefix. Bundle lands at $(INSTALL_PREFIX)/clide/ with a