build(libs): publish static libraries as immutable libs-<n> releases

[datlechin]

Why

• libs-v1 is a mutable release: every publish replaced its archives with --clobber, so an old commit could download libraries it was never built with.

Change

• publish-libs.sh publishes Libs/*.a and Libs/ios/*.xcframework as the next immutable libs-<n> (draft, then publish, --latest=false both times), checks it is immutable, then writes Libs/release and both checksum files. It refuses a libs-* draft, a branch behind the newest libs-<n>, unnamed changes, and an unchanged publish over an immutable pin.
• download-libs.sh reads the tag from HEAD:Libs/release, keeps it in the marker and downloads again when the pin moves. The "any .a exists" skips are gone.
• publish-ios-libs.sh is deleted. The build scripts print the new publish command.
• libs-2 is published from this branch: the same files as libs-v1, checksums unchanged, archives without AppleDouble entries or xattrs.

Verified

• scripts/ci/test_libs_release.sh, new in Repo Hygiene, runs both scripts against a stub gh (macOS bash 3.2 and Linux).
• gh release view libs-2 --json isImmutable is true, releases/latest is still v0.81.0, and download-libs.sh --force verifies libs-2 against the committed checksums.

Not in this PR

• RELEASING.md (Static libraries) and CONTRIBUTING.md:31 still describe libs-v1 and publish-ios-libs.sh; verify.sh agent-docs flags RELEASING.md:61 until that rewrite lands.