Cut a bnot release — compute next version, push main, and create a GitHub release that triggers the build/sign/notarize workflow.