ci: add `semantic-release` job

_Eventually_, we want to be able to drive `semantic-release` from Bazel.

However, that requires hermetic resolution of `git` and `ssh` which is a
challenge that we do not have time for at this time.