Auto-increment versions and generate release notes

[springwq]

Replaces the manual `version` input with automatic versioning, and makes release pages look like cli/cli's.

Changes

• No more version input: validate computes the next version from the latest tag + `bump` input (`patch`/`minor`/`major`, default `patch`). All downstream jobs use the computed version.
• New `bump` job (publish only): commits the `version.rb` bump to `main` as the release bot; build/assemble/publish/formula-pr all check out that commit, so `fm version` reports the released version. Idempotent — a failed run leaves no tag, so re-running computes the same version.
• cli/cli-style release notes: `script/publish-release` now calls the generate-notes API (What's Changed from merged PRs since the previous tag) and appends the checksums; the release is tagged at the exact bump commit via `--target`.
• Dry-run behavior unchanged (no bump, no writes), all gates unchanged (confirm=release, release environment on main, not-released check).

Verified locally: bump step mechanics in a temp repo (version rewrite, commit, push, sha output), version computation against real tags (v0.1.0 → 0.1.1 / 0.2.0 / 1.0.0), workflow YAML + embedded shell syntax, full test suite and RuboCop.