Add multi-target OreSpawn release dispatcher

[SkyBlade1978]

Summary

• add the default-branch dispatcher required for OreSpawn release workflows to be started manually or by a validated tag starter
• support validate-only, verify-secrets, and publish modes with selectable CurseForge release, beta, or alpha channels
• derive the target from branch metadata and require the four-component release version to match Minecraft version and loader
• require an exact publication tag, matching confirmation version, and a successful Build, test, and audit check for that commit
• build the selected ref once and retain one immutable bundle containing the three public jars, SHA256SUMS, and CHANGELOG.txt
• publish sequentially to Maven, CurseForge project 245586, and GitHub Releases after the release environment gate
• fail closed when required Maven or CurseForge secrets are unavailable

The workflow is target-generic. Forge 1.10.2 is the first target to provide the required metadata and tag starter; later OreSpawn branches can adopt the same contract without duplicating the dispatcher.

Safety controls

• GitHub Actions are pinned by commit
• publishing requires the exact version tag and matching target suffix
• Maven cannot fall back to a runner-local repository
• the same audited bundle is used for every destination
• alpha and beta produce GitHub prereleases
• concurrency is keyed by release ref and does not cancel an active publication

Validation

• the workflow passes actionlint
• its committed diff passes git diff --check
• exact dispatcher candidate: a0298d3021809f8eeac2dc8f5e96d47e1692379d
• the Forge 1.10.2 product branch and its target metadata are merged in MMD PR Release OreSpawn 4.0.8 for Forge 1.10.2 #244, whose post-merge CI, CodeQL, and wrapper-validation runs passed

Publication boundary

Merging this PR only makes the dispatcher available on the default branch. It does not create a tag, invoke publish mode, or upload anything to Maven, CurseForge, or GitHub Releases.