publish: release the matching iris by proxy

iris is versioned as portal. On a tag push this job clones uhhm/iris,
re-pins its portal dependency to the tag, sets its version to match,
builds and tests it, writes the changelog line, and pushes the commit
and tag - which iris's own CI publishes. The tarball ships the binary
just built. A portal change to something the lint reads fails the
release at this step. Needs the IRIS_PUSH_USER variable and
IRIS_PUSH_TOKEN secret on this repo.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4jrCgLiKKHAEFuZUJjckH

README.md

@@ -98,9 +98,11 @@ stream.
 
 - `portal` — the server (Leptos SSR + hydrate, Axum underneath).
 - `iris` — the lint, from [uhhm/iris](https://project.uhhm.no/uhhm/iris),
-  which depends on this crate as a library pinned to a release tag.
-  Every release tarball ships the matching `iris` binary
-  (`IRIS_RELEASE` in `publish.yml`), so each content repo's CI can
+  which depends on this crate as a library pinned to a release tag and
+  carries the same version: the publish job here re-pins, tests and tags
+  iris for every portal release.
+  Every release tarball ships that `iris` binary
+  too, so each content repo's CI can
   lint with the exact portal version its instance runs:
   `iris check --path <dir>`.