ci: add Cut Release workflow for patch/minor/major cuts

[santiagomed]

Summary

• Adds Actions → Cut Release (workflow_dispatch) to automate a release cut from main
• Promotes CHANGELOG.md ## Unreleased → ## vX.Y.Z - <date>, opens a release PR (required by branch protection), tags after merge, then publishes (GitHub release, Homebrew, npm)
• Helper script scripts/cut_release.py (+ unit tests) resolves the next semver and rewrites the changelog
• Publish runs in this workflow because tag pushes with GITHUB_TOKEN do not trigger the existing tag-based Release workflow

Usage

# dry-run (no PR/tag/publish)
gh workflow run "Cut Release" -f bump=patch -f dry_run=true

# cut a patch from main
gh workflow run "Cut Release" -f bump=patch

# explicit version
gh workflow run "Cut Release" -f version=1.2.3

# after a release PR is approved+merged manually
gh workflow run "Cut Release" -f version=1.2.3 -f skip_changelog=true

Test plan

• python3 -m unittest cut_release_test in scripts/
• python3 scripts/cut_release.py --bump patch --dry-run against current main
• Merge this PR, then Actions → Cut Release → dry_run=true
• (optional) Run a real patch cut when ready to ship v1.2.3