Harden repository release workflow

[t1ktakdev]

This keeps release and maintenance work predictable without changing application behavior.

Changes:

• build Windows releases automatically from version tags;
• refuse a release when Cargo, Tauri, and package versions disagree with the tag;
• run the Rust and frontend quality gates before publishing an installer;
• attach the NSIS installer plus SHA256SUMS.txt to the GitHub release;
• group routine Dependabot updates to reduce PR noise;
• organize generated release notes;
• route security reports through the existing security policy instead of blank issues.

The release workflow only runs on v*.*.* tags. Normal pushes and pull requests continue to use the existing CI workflow.