Announce releases and tags

[LeeJMorel]

Problem

GitHub sends release and create. Neither reached any app here, so an automation could hear an issue open and could not hear a ship — a release going out, or a tag being pushed.

What changed

Three new emissions and one new read.

Emission	GitHub event	Carries
release-published	release / released	repository, owner, tag, name, branch, url, author
prerelease-published	release / prereleased	same
tag-created	create / ref_type: tag	repository, owner, tag, url, author

list-branches is a new read, filling the control that narrows a release trigger to the branch it was cut from.

Three decisions worth arguing about:

• Two release ids, not one published plus a flag. GitHub already separates released from prereleased. A subscriber pays for a delivery before any of its own conditions run, so "only what we ship" has to be answerable at subscription time — a boolean on one emission means every nightly pre-release costs a run first.
• A tag has no branch, and it is not given one. A tag points at a commit and a commit sits on any number of branches; master_branch on that payload is the repository's default and is the same answer whatever was tagged. The branch question belongs to a release, where target_commitish really answers it.
• An announcement now carries its own returns and its own builder. Two side tables keyed on the GitHub event name held for exactly as long as every announcement was issue-shaped. A tag has no number and no title.

Permissions — needs an operator step

Both events are delivered only to an app holding contents: read, so PERMISSIONS gains it (read-only; nothing here writes through it, nothing reads a file).

For an app already registered, this has to be changed on the GitHub App's Permissions & events page — GitHub has no API for an app to widen itself — and then every installation stays on the grant its owner already approved until they approve the new one. Until then the events do not arrive and nothing looks broken. README gained an "Upgrading an app that is already registered" section saying so.

Testing

npm run typecheck
npm run manifest          # the three existing emissions are byte-identical
DATABASE_URL=… npm test   # 380 passed (380)

The manifest fixtures gained one delivery per new emission, plus a case that pins the create discriminator: a branch creation arrives on the same event and must translate to nothing.