ci: publish Cloudflare Worker bundle on tagged release

[evangineer]

Summary

Add a CI workflow that builds a self-contained Cloudflare Worker bundle on every tagged
release and attaches it as a GitHub release artefact. This removes the requirement for
holo-platform-cli to have the joining-service source repo checked out locally — it can
instead download a pinned worker.js + wrangler.toml directly from a release tag and
deploy with wrangler deploy --no-bundle.

Changes

• .github/workflows/release.yml — new tag-triggered workflow: runs the test suite,
  then builds the Worker bundle with wrangler deploy --dry-run --outfile and uploads
  dist/worker.js and deploy/cloudflare/wrangler.toml to the GitHub release
• deploy/cloudflare/wrangler.toml — two updates:
  • KV namespace ID placeholders changed from REPLACE_WITH_KV_NAMESPACE_ID to
    __SESSIONS_KV_NAMESPACE_ID__ / __SESSIONS_KV_PREVIEW_NAMESPACE_ID__ (sed-friendly
    for automated substitution by holo-platform-cli)
  • Added compatibility_flags = ["nodejs_compat"] — required because several source
    files (utils.ts, email-code.ts, delegated-verification.ts, lair-signer.ts)
    use node:crypto; without this flag the bundled worker raises runtime errors on
    Cloudflare Workers
• package.json — add wrangler@^4.86.0 as a devDependency so the workflow uses
  the repo-pinned version
• package-lock.json — update @holo-host/lair from file: local path to
  https://registry.npmjs.org/@holo-host/lair/-/lair-0.1.2.tgz (0.1.1 had a packaging
  bug where dist/mnemonic.js was missing from the tarball; 0.1.2 is the correct
  published release)

How the platform CLI consumes this

// download pinned release artefacts
const workerUrl = `https://github.com/Holo-Host/joining-service/releases/download/${version}/worker.js`;
const tomlUrl   = `https://github.com/Holo-Host/joining-service/releases/download/${version}/wrangler.toml`;
// substitute KV namespace IDs, then:
// wrangler deploy --no-bundle worker.js -c wrangler.toml

Test plan

• npm test — 272/273 pass (1 pre-existing Shoelace UI failure unrelated to this change)
• npm run typecheck — passes
• wrangler deploy --dry-run --config deploy/cloudflare/wrangler.toml --outfile dist/worker.js — builds cleanly, no warnings, 387 KiB gzip
• Verified package-lock.json resolves @holo-host/lair from npm registry at 0.1.2 (not file: path)

Closes #10