Automate preview releases after merging pull requests

[CHOS1N11111]

Merged PRs currently require a manual build and release. Add Publish Preview to test each PR merged into main, build its exact merged source, and publish a universal macOS app plus browser extension as a preview release.

• Automatically allocate the next patch version and build number, synchronize the packaged app/extension versions, and generate release notes. Publish the DMG, app ZIP, browser extension ZIP and SHA-256 checksums only after all assets are uploaded and verified.
• Queue concurrent merges and reserve versions in drafts so interrupted builds/uploads can resume without duplicate releases or moving existing tags. Provide a manual entry point for a merged PR and leave completed releases intact on reruns.
• Add a read-only PR workflow that runs tests and verifies packaging. Keep version changes in temporary build sources, use the repository token, and document setup, retry behavior and the existing ad-hoc signing limits. Point both READMEs to the Releases page so download links do not become stale.