fix(release): create the release commit via GitHub's GraphQL API

[tbjers]

Summary

• feat: add automated release workflows #46 merged release-prepare.yml in its original form, which runs a plain git commit in the runner (as the unauthenticated github-actions[bot] git identity) and pushes it to the new release/vX.Y.Z branch.
• main requires signed commits. Confirmed via a real run (PR chore(release): v0.3.0 #47, now closed): the resulting release/v0.3.0 branch's commit shows "verified": false, "reason": "unsigned" via the GitHub API, so that PR could never be merged as-is.
• This PR replaces the local git commit/git push step with .github/scripts/create-verified-commit.mjs, which uses the createCommitOnBranch GraphQL mutation to create the commit through GitHub's API instead. API-created commits are automatically shown as Verified — no bot signing key to generate, register, or rotate.
• The release branch ref itself is now created via the REST Git Data API (git/refs) pointing at the base main SHA, then the verified commit is added on top of it.

Test plan

• Verified locally that an API-created commit shows "verified": true (confirmed on the earlier attempt at this fix, before feat: add automated release workflows #46 merged ahead of it)
• Run "Prepare release" (workflow_dispatch) once this merges and confirm the release/vX.Y.Z branch's commit is verified: true and the resulting PR is mergeable under the signed-commits ruleset
• Clean up the stale release/v0.3.0 branch and closed PR chore(release): v0.3.0 #47 from the earlier failed attempt

🤖 Generated with Claude Code