Add guarded basectl release publish

[codeforester]

Summary

• Add guarded basectl release publish support for creating annotated tags, pushing release tags, and creating GitHub Releases from changelog sections.
• Reuse release readiness checks and block publish when the worktree, tags, GitHub CLI auth, changelog, or existing GitHub Release state is unsafe.
• Expand Homebrew handoff output with tap, formula, archive, checksum, validation, and upgrade smoke commands while keeping tap mutation manual.

Validation

• BASE_HOME="$PWD" PYTHONPATH="$PWD/lib/python:$PWD/cli/python" /Users/rameshhp/.base.d/base/.venv/bin/python -m pytest cli/python/base_release/tests/test_engine.py -q
• PYTHONPATH=lib/python:cli/python /Users/rameshhp/.base.d/base/.venv/bin/python -m pylint --rcfile=.pylintrc cli/python/base_release/engine.py cli/python/base_release/tests/test_engine.py
• BASE_HOME="$PWD" bats cli/bash/commands/basectl/tests/release.bats cli/bash/commands/basectl/tests/help.bats cli/bash/commands/basectl/tests/completions.bats
• Temp-project dry-run smoke with stubbed gh
• git diff --check
• env -u BASE_HOME ./bin/base-test

Demo Impact

• basectl release publish --version <version> --dry-run now shows the GitHub publish plan and Homebrew handoff without creating artifacts.
• basectl release publish --version <version> --yes can create the annotated tag, push it, and publish the GitHub Release after all readiness checks pass.

Closes #543
Closes #544
Closes #540