ci: attach only plugin files to GitHub releases

[luoxuanzao]

Obsidian only downloads main.js, manifest.json, and styles.css, and the review bot flags LICENSE/NOTICE as unsupported extras. The MIT license and Claudian attribution stay embedded in the main.js banner and in the repository files, which the release notes now link to.

Summary

• What changed?
• Why is it needed?

Verification

• npm run typecheck
• npm run lint
• npm run test
• npm run build
• npm run release:check
• npm run audit:prod
• Tested affected qodercli behavior against a real CLI when applicable

Safety

• No credentials, private vault content, internal URLs, or personal paths are included
• User-visible changes are documented in CHANGELOG.md