Prerelease on every merge, promote by tag, and pair each library release with its browser build

Two gaps in how Camoufox is released today:

1. Nothing is released on merge. The browser is built only from a manually pushed tag (into a draft release someone publishes by hand), and PyPI/npm only by a manual dispatch. A merged fix can sit unreleased for weeks, and nobody can try main without building it.
2. A library release is not tied to a browser build. camoufox fetch installs the newest build in a channel and a launch uses whatever is marked active, so upgrading the library can run it against a browser it was never tested with, and an older library picks up a newer, incompatible browser (the reason PLAYWRIGHT_BROWSER_FLOORS exists).

Wanted: every tested merge to main publishes a prerelease of the browser, the PyPI package and the npm package — opt-in only for users — and a maintainer promotes a tested commit to stable with a tag, with no rebuild. Every library release fetches and launches exactly the browser it was released with unless the user explicitly chooses another.