Add a create-release action

[t4k]

Tags a commit and opens a draft GitHub release with artifacts attached.

Always a draft. Publishing stays a human act — someone reads the notes,
checks the artifacts and presses the button. Nothing here publishes, and
nothing here decides a version: the caller has already bumped whatever holds
it and committed that, so this tags what is in front of it.

target

Defaults to HEAD, but exists because the commit worth tagging is usually not
the one that bumped the version. Where a release regenerates metadata from a
version field, the tag belongs on the commit carrying the regenerated files —
otherwise the archive ships metadata describing the previous release.

Refusals

It stops rather than producing something that looks fine and is not:

• the tag already exists
• a release already exists for that tag
• an artifact is missing
• an artifact is zero bytes — a release whose files are empty looks
  healthy until someone downloads one

Tested

Against a scratch repository: the dry run prints the exact gh release create
it would run; a missing --tag exits 2; a missing artifact, an empty artifact
and an existing tag each exit 1. shellcheck --severity=style is clean, and
the README-documents-every-input check passes for all seven actions.

For the terminal

bin/create-release.sh is the implementation and the action is a wrapper, so
the same thing runs from a maintainer's own shell with gh authenticated as
them. That is the point of keeping the logic in a script — see
ADR-0005.

Note on releasing this

A caller in caltechlibrary/CL-web-components uses create-release@v1, so
this needs a release and a v1 move before that caller works. The changelog
entry is under [Unreleased].