Tag-triggered (v* on the Forgejo mirror) instead of a hand-made GitHub
release. Adds an aarch64-linux leg; a single publish job creates the GitHub
release and mirrors every binary back onto the matching Forgejo release via
FORGEJO_RELEASE_TOKEN. Keeps the hurl HTTP contract harness on x86_64-linux.
Assumed v* tags are the release trigger and the contract tests run once on the
deploy target (x86_64-linux); flag if either is wrong.
On a published GitHub Release, for each target (amd64 Linux, arm macOS) run
the Rust test suite and the hurl HTTP contract tests, build the release
binary on a stable toolchain, and upload it as a target-named asset on the
triggering release. Trigger is release:published per ANW-29 -- aav creates
the release and tag in the UI; the workflow never creates them.
