fix(release): publish via GitHub REST — gh CLI is not installed in any image (#331)

ReleaseExecutor.publish_release shelled out to 'gh release create', but no
Dockerfile installs the gh CLI (verified missing in the live orchestrator
container), so an armed release manager died at publish AFTER the release
commit was pushed. Publish now POSTs /repos/{owner}/{repo}/releases with the
project's decrypted token — same auth/httpx pattern as PR creation, same
fail-closed semantics (non-201 -> structured publish_failed, CEO retries;
the 300s deadline is the httpx client timeout). Subprocess publish-timeout
test replaced with REST-path tests (201/non-201/transport-error/no-token).

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

tests/unit/services/test_release_executor.py

@@ -190,17 +190,17 @@ async def test_commit_push_failure_returns_structured_commit_failed() -> None:
 
 @pytest.mark.asyncio
 async def test_publish_failure_returns_structured_publish_failed() -> None:
-    """#88: a RuntimeError from ``gh release create`` (auth/quota/network) becomes
+    """#88: a RuntimeError from the GitHub release POST (auth/quota/network) becomes
     a structured ``publish_failed`` result. The commit is already pushed and CI
-    is green, so the release is half-landed — the CEO can retry ``gh release
+    is green, so the release is half-landed — the CEO can retry the publish
     create`` for the same version (the executor is idempotent on the commit
     side). No 500."""
-    ops = _FakeOps(publish_raises="gh release create failed: forbidden")
+    ops = _FakeOps(publish_raises="release publish failed: HTTP 403: forbidden")
     result = await ReleaseExecutor(ops).execute(_report())
     assert result.status == "publish_failed"
     assert result.commit_sha == "deadbeef"
     assert result.release_url is None
-    assert "gh release create failed" in result.detail
+    assert "release publish failed" in result.detail
     assert ops.calls.count("publish") == _ONE