fix: make release creation safe to rerun

[Humerous]

Closes #554

Summary

• check whether the GitHub release already exists before creating it
• skip creation on reruns while continuing to asset upload
• fail on unexpected release lookup errors
• add a regression contract test and CI coverage

Validation

• bash tests/release/release-create-rerun.test.sh
• bash scripts/check_test_reachability.sh
• bash tests/release/crates-index-poll.test.sh
• git diff --check

[vladimirrott]

Thanks, @Humerous. This is the fix #554 asked for, and the lookup is three-way, which is the part that's easy to get wrong: release exists → skip, release not found → create, anything else → ::error:: and exit 1. A 401 or a network failure stops the job instead of falling through to a create.

Reviewed at 5ce1f05. What I checked:

• The workflow diff adds no ${{ }} inside run:, no new actions, no permission or trigger change. VERSION and REPO still arrive through env:.
• release not found is the exact string gh prints (ErrReleaseNotFound in gh's pkg/cmd/release/shared/fetch.go), and a read-only gh release view of a missing tag printed it.
• Reverting the release.yml hunk to the old unguarded gh release create turns release-create-rerun.test.sh red, and so does short-circuiting the existence check (the merge receipt). check_test_reachability.sh passes with the new ci.yml step.
• I also ran the shipped run: block under bash -e with a fake gh: exists creates 0, missing creates 1, auth error and network error both exit 1 and create 0.

Two optional notes, neither blocking:

• gh release view also finds drafts, so a draft with the same tag would receive the assets and stay unpublished. Only someone with contents: write can make one, so it's a maintainer-tier edge. --json isDraft would close it if you want to.
• The test checks the step's shape with strict regexes. It fails safe on a reformat, and a fake-gh behavioural test would be sturdier later.

For a next one in the same file family: #622. cargo audit only runs on push, so last week main sat on four rustls advisories for about 38 hours before any run noticed. It's one scheduled workflow modelled on npm-audit.yml plus a YAML contract test like the one you just wrote. I'll offer it on the issue once this lands.