ci: make the existing Git release workflow reusable

[ttaylorr-oai]

Review the new changes only.
The change above #80 is four files, +237/-37.

Make the existing release workflow callable with a source commit, version,
upstream tag, and recipe pin. Calls run its six native builds without starting
its publisher. Public pushes retain their controller-output check and release
path, with a distinct version suffix for codex-unstable.

Use the manifest helper for the existing archive checksum and size checks,
and remove those duplicate checks from the workflow. Verify six build
receipts before attaching the manifest.

This topic follows #80, including its Debian 12 CI image update, so the
controller applies the CI prerequisites before the callable-workflow changes. Its release workflow and manifest helper are byte-for-byte identical
to the previously approved 4209f5e2907f version. The explicit dependency
removes replay conflicts without changing the build recipe or PGO inputs.

Validation: the five release-related topics replay together without conflicts,
and the resulting release files exactly match this source. The landed
controller accepts the source and replayed publication guards and CI pins.
The manifest test is registered with Meson; its registration check fails
before that one-line fix and passes after it. All nine manifest cases pass with Bash 3.2. The symlink case requires
SYMLINKS; without it, the other eight cases still pass, including
unexpected-file rejection. Windows Meson shard 9 passes in both the push
and pull-request runs after that test fix.
The Debian restack changes only the CI image; all release and test files are
unchanged. CI is running on the new head. A hosted native canary remains.

This is a source-review topic for pinned plan admission. Do not merge it
directly into the generated codex branch.