fix(release): bind asset upload repository

[rabii-chaarani]

Summary:

• pass the repository explicitly to the checkout-free GitHub Release upload
• reject release workflows that rely on local Git metadata for repository discovery
• document the checkout-free publisher contract

Root cause:
Run 32000102755 downloaded and validated all artifacts, then gh release upload failed because the publisher intentionally has no checkout and therefore no .git directory from which gh could infer the repository.

Verification:

• cargo fmt --all -- --check
• cargo test -p xtask --locked
• cargo run -p xtask --locked -- check-workflows
• cargo run -p xtask --locked -- release-gate
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• read-only gh release lookup from outside a Git repository