v0.65.3 — Release pipeline fix (final)

Patch release of v0.65.2. All v0.65.0 functional changes apply — see v0.65.0 release notes for the SR-001..SR-024 security-hardening details and pre-deploy checklist.

What changed since v0.65.2

No code changes — this release adds the four RELEASE_MANIFEST_* repository secrets that the SR-024 release-manifest signing requires. v0.65.2's Create Release job failed because those secrets were absent; the underlying signing pipeline is now functional end-to-end.

This is the first v0.65.x tag where the full pipeline (binaries, macOS sign, manifest signing, GHCR push) should complete cleanly.

Full Changelog: v0.65.2...v0.65.3