Automate release lifecycle: bump type input, changelog gen, notarization cleanup

[Copilot]

The release workflow required manual version strings, hand-edited changelogs, and exposed four Apple secrets directly to the build step. This replaces that with a fully automated, dispatch-driven pipeline.

Inputs

• bump_type choice (patch / minor / major) — version computed from latest semver tag, falling back to CHANGELOG.md
• create_release boolean (default true) — dry-run flag: build + upload artifacts without publishing

Pipeline changes

• Version compute — reads latest v*.*.* git tag, applies bump; no manual version entry
• Conventional-commits release notes — parses commits since last tag into ⚠️ Breaking / ✨ Features / 🐛 Bug Fixes / 🔧 Other; written to $RUNNER_TEMP/release_notes.md used for both the CHANGELOG and the release body
• CHANGELOG.md auto-update — Python one-liner inserts ## [X.Y.Z] — DATE below ## [Unreleased]
• Casks/simulatorcamera.rb auto-update — version bumped before build; real sha256 back-filled from the .sha256 artifact after build (fails loudly if missing)
• Notarization — credentials stored once under a named keychain profile (SimulatorCameraNotary); build step receives only KEYCHAIN_PROFILE — APPLE_ID / APPLE_APP_PASSWORD never enter the build environment
• Tag + release — created after a successful push of the version-bump commit; target_commitish resolves to branch HEAD at API-call time (i.e. the bump commit)
• test-spm gates the build with permissions: contents: read

Removed

• push: tags: v*.*.* trigger — workflow is now the sole release entry point
• APPLE_DEVELOPER_ID secret from build step (was documented but never used)
• docs/RELEASE_NOTES_vX.Y.Z.md manual file requirement

build-release.sh

Doc comment updated: removed unused APPLE_DEVELOPER_ID, clarified KEYCHAIN_PROFILE as the preferred notarization path.

RELEASING.md

Replaced multi-step manual runbook with the automated workflow description and a secrets reference table.