refactor(release): rename workflows and align update-release path

Rename the reusable workflows to release.yml and update-release.yml,
add UPX compression for release binaries, and sync the standalone
update-release workflow with the active release pipeline fixes.
Update README, AGENTS, compliance notes, and changelog references to
match the new workflow names and usage patterns.

COMPLIANCE_ANALYSIS.md

@@ -154,8 +154,8 @@ if err != nil {
 **Workflows analyzed:**
 
 - [push-validation.yml](.gitea/workflows/push-validation.yml)
-- [prepare-release.yml](.gitea/workflows/prepare-release.yml)
-- [do-release.yml](.gitea/workflows/do-release.yml)
+- [release.yml](.gitea/workflows/release.yml)
+- [update-release.yml](.gitea/workflows/update-release.yml)
 
 #### What's Implemented
 
@@ -171,7 +171,7 @@ if err != nil {
 - ✅ Coverage badge publication
 - ✅ Release tag recommendation on `main` branch
 
-**prepare-release.yml:**
+**release.yml:**
 
 - ✅ Go setup and caching
 - ✅ Tests run before release preparation
@@ -361,7 +361,7 @@ validate
 
 **Effort Invested:**
 
-- CI/CD improvements: workflow hardening in `push-validation.yml` and `prepare-release.yml`
+- CI/CD improvements: workflow hardening in `push-validation.yml` and `release.yml`
 - Code organization: injected service boundaries for filesystem, environment, and git access
 - Local automation: `justfile` validation parity for format, modules, tests, and security
 - **Primary commits:** 7cb7b05, 383aad4, 5c903c9