ci(release): add dev flavor artifacts to release workflow

[xjdr-noumena]

Summary

Release workflow now builds two flavors per supported platform (linux-x64, darwin-arm64, darwin-x64):

• default flavor: asset name ncode-VERSION-${slug}.zip
• dev flavor: asset name ncode-VERSION-dev-${slug}.zip

Both flavors build from the same source commit via an extended build matrix (3 platforms × 2 flavors = 6 build jobs). The publish job assembles all artifacts into a single GitHub release per tag, with .sha256 checksum sidecars, .manifest.json files, and artifact attestations preserved for both flavors.

What changes

• .github/workflows/release.yml: build matrix extended with a flavor dimension (default, dev). Each flavor runs the appropriate build mode via build/packageSmoke.mjs --build-mode <mode> and emits asset names with the flavor suffix. Cargo cache key includes the flavor to avoid cross-flavor cache poisoning. Publish job downloads release-assets-* with merge-multiple (unchanged shape, now picks up 6 artifacts instead of 3).
• build/packageSmoke.mjs: adds --skip-exposure-audit flag. Default flavor keeps the source exposure audit enforced; dev flavor skips it (dev legitimately enables additional surfaces that the audit would otherwise flag).
• RELEASING.md: documents the two-flavor release contract and the secrets policy.
• CHANGELOG.md: one-line entry.

Verification

Local dev-flavor smoke passed:

bun build/packageSmoke.mjs --build-mode <dev> --target bun-linux-x64 \
  --out-dir /tmp/ncode-dev-smoke --no-native-probe --skip-exposure-audit --keep-output
→ ok: true, version check 459ms, help check 637ms

YAML parse: pass. Package smoke script arg parse: pass.

CI dry-run + tag-triggered release will prove both flavors across all three platforms end-to-end. Both flavors of 0.2.0 will land as release assets on the same GitHub release when v0.2.0 is tagged.

Out of scope

• Auto-updater wiring to point at GitHub release assets (deferred; not touched in this PR).
• 0.2.0 version bump and CHANGELOG move from [Unreleased] to [0.2.0] section (separate release-cut PR).

Refs #45.