Build, verify and publish dist/<id>.plugin to the Releases tab on every
push to main. Nothing is plugin-specific: the id and version are read
from plugin.json, so the workflow keeps working once this template is
renamed into a real plugin.
The version in plugin.json decides what happens: a new version creates
tag v<version> and a new release, while an unchanged version rebuilds the
existing release and replaces its attachment. The tag is never moved, so
it keeps pointing at the commit that first introduced that version, but
the release notes are refreshed to name the commit the build came from.
The upload is gated on verify_bundle.py, so a bundle that fails offline
verification is never published. dist/ stays gitignored and the artifact
is always built by CI rather than committed.
