chore: add capability-scoped release automation

[GangGreenTemperTatum]

Summary

• add a planner that detects capability.yaml version bumps and maps them to capability-scoped GitHub release tags
• create GitHub Releases after successful main-branch capability sync using GitHub generated release notes
• add tests for version bump detection, unchanged manifests, previous tag selection, and duplicate tag skips

Release convention

Tags use capability/<capability-name>/v<manifest-version>, for example capability/ai-red-teaming/v1.3.7. Releases are created with --generate-notes and --notes-start-tag when a prior tag for that same capability exists.

Validation

• uv run pytest tests/test_capability_release_plan.py -q
• pre-commit run --files .github/workflows/sync.yml scripts/capability_release_plan.py tests/test_capability_release_plan.py
• just validate (passed with existing capability check warnings only)