- Add `prepare-release` job to validate refs, bump app versions, commit, and push tag
- Build jobs now check out the release tag and consume propagated version/tag outputs
- Publish job now targets the generated tag and uses arch-specific checksum artifacts