ci(release): publish only after all checks pass; add 0.4.0 notes

[damianh]

Prepares the 0.4.0 release.

Release workflow

Previously the tag was pushed before any build/test ran, and NuGet was pushed before the container tests. A failed run could leave a dangling tag or an irreversible NuGet package.

• Tag is created locally up front (MinVer still versions the build) and pushed only after GHCR and NuGet publishing succeed.
• Replaces "Remove existing tag" (which could delete a released tag) with a guard that fails if v<version> already exists on origin. Failed runs no longer push the tag, so reruns still work.
• NuGet push moved after all container contract/example/smoke tests.
• Curated notes from .github/release-notes/v<version>.md are prepended to the generated notes when present; otherwise generated notes only.

Release notes

Adds .github/release-notes/v0.4.0.md with highlights (admin UI, Testcontainers support) and upgrade notes (SQS URL strategy change + legacy switch, obsolete MICROSTACK_UI_PORT/MICROSTACK_API_URL, Aspire latest impact).

Validated with actionlint.

[coldtea-pr-lens]

◈ PR Lens

Note

The title starts with ci(release):, so PR Lens left this pull request undrawn. Comment @pr-lens draw to draw it

_{github.comment.notice: false in .github/pr-lens.yml turns this note off}