ci: build and publish riscv64 binaries in release workflow

[congwang-mk]

Problem

v0.8.2 added riscv64 support, but no riscv64 binary appeared on the GitHub Release page.

The riscv64 build existed only in ci.yml (rust-riscv64-cross), which runs on push/PR to main as a compile-regression guard and never packages or uploads anything. release.yml (triggered by v* tags) only built x86_64 and aarch64, so the release assets never included riscv64.

Fix

Add a riscv64gc-unknown-linux-gnu entry to the release.yml build matrix:

• Cross-compiled on ubuntu-latest (no native riscv64 runner exists), reusing the cross-toolchain setup from ci.yml (gcc-riscv64-linux-gnu plus linker/CC env vars).
• A new conditional "Set up cross toolchain" step derives the CARGO_TARGET_*_LINKER / CC_* env var names from the target triple, so it generalizes to future cross targets.
• Marked experimental: true with continue-on-error, so an untested cross-build regression cannot block the x86_64/aarch64 release or the crates.io/PyPI publish.

Caveats

• The riscv64 binary is cross-compiled and never executed in CI (seccomp/Landlock do not emulate faithfully under qemu; the real test suite runs on a physical riscv64 host).
• This does not retroactively add a binary to the already-published v0.8.2 release. After merge, either re-run the Release workflow via workflow_dispatch or cut a new tag.