feat: introduce oliphaunt

[f0rr0]

Summary

• reintroduce the full Oliphaunt stack as one clean commit on top of the 0.5.1 release point
• exclude the previously merged release-please version/changelog/manifest bump so a fresh release PR can be generated after this lands
• keep the post-release fixes from fix(native): link macos extension artifacts through liboliphaunt #81, fix(release): make wasix cargo archives portable #82, and fix(release): verify release-please product tags #83
• keep the publish-token permission fix so release-please can complete its GitHub release comment during publish

Release flow after merge

After this PR merges, run the Release workflow on main with operation=prepare-release-pr. Merge that fresh release PR, then run operation=publish from main with release_commit left blank.

Validation

• tools/dev/bun.sh tools/release/release-check.mjs
• tools/dev/bun.sh tools/release/check_release_please_config.mjs && tools/dev/bun.sh tools/policy/check-release-policy.mjs
• git diff --check
• confirmed the obsolete release tag retarget step is not present