chore: improve release pipeline

[stefan-gorules]

Release pipeline

This PR reworks how ZEN is versioned, built, and published. release-please now drives every release, each binding builds and publishes from a single workflow, and the Linux targets cross-compile on one runner instead of a grid of containers.

How a release flows

• release-please tracks all versions in one manifest. The six core crates move together as a group, and the cargo-workspace plugin rewrites the inter-crate version requirements and cascades a bump to anything that depends on a changed crate.
• The node, python, and uniffi bindings version independently.
• Publishing is gated by the tag release-please creates - zen-engine-v, nodejs-v, python-v, uniffi-v - so each workflow only runs for its own component. The old "publish when the commit message says so" gates are gone.
• Betas come from master through release-please's prerelease mode. During a beta window every component, uniffi included, gets an X.Y.Z-beta.N, and npm publishes those under the next tag.

Build and caching

• One workflow per binding - go, node, python, rust, uniffi - plus a shared setup-rust composite action that every Rust-compiling job uses. It bundles dependency and compiler caching, the zig toolchain, the target glibc, and a Windows Defender exclusion, so each workflow stays short and they don't drift apart.
• Linux targets cross-compile on a single ubuntu runner through zig, with glibc pinned low for portability. mac and windows build on their own native runners - their SDKs can't be supplied from Linux, so cross-compiling them isn't worth the fight.
• rust.yaml is down to test, fmt, and release. A duplicate build job and the beta-toolchain leg were removed, and tests run in debug only - more checks, faster to compile - while keeping the feature matrix that actually changes behaviour.

Python

Python builds a single abi3 wheel rather than one per interpreter. The same cp38-abi3 wheel runs on CPython 3.8 and every newer 3.x, including versions that don't exist yet, so a new Python release no longer means new wheels. The Linux build is cached now, where before it had none.