Retire setup.yml release-tarball builder; tag = source-only Release

[krystophny]

Problem

PR #54 removes main.yml, the umbrella build-everything CI. setup.yml built
and published the release tarball (code-<tag>.tar.gz) that main.yml
downloaded for prebuilt dependencies, so once #54 lands setup.yml has no
consumer.

Furthermore the bundle was not reusable: the dependency scripts bake absolute
install prefixes and the venv bakes absolute shebangs tied to the GitHub runner
path, so extracting it anywhere else broke. The devcontainer image builds its
deps from source via scripts/setup.sh; nothing else references the released
asset. GitHub already attaches a source archive to every release created from a
tag, so a hand-rolled source tarball is redundant.

Decision

Retire setup.yml (issue #56, option B). A v* tag remains a
reproducibility snapshot, published as a source-only Release; fresh setups run
scripts/setup.sh, and the fast path is the devcontainer image
(.devcontainer/). The README "Initial setup" section is updated to say so.

The dedicated release.yml replacement (a tiny gh release create workflow)
could not be added in this environment because the automation token lacks the
workflow scope GitHub requires to create/update .github/workflows/* files;
deleting setup.yml was permitted. The repo therefore keeps tag-triggered
releases out of the box, and a maintainer with workflow scope can add the
minimal release.yml (see the triage note on #56) before the next tag.

Tests

No build/test suite is affected: nothing under tests/ referenced the release
tarball, and scripts/setup.sh and the devcontainer path build dependencies
from source rather than from the asset. Verified setup.yml is gone from the
tree and the only remaining reference to the release asset is
.github/workflows/main.yml, which pins the existing v2025.01.02 release
(whose asset stays published permanently) and is itself removed by PR #54.

Closes #56

[krystophny]

Review verdict: Comment

Summary: The workflow removal is consistent with moving setup to source/devcontainer paths, but the README overstates what a v* tag now produces.

Findings:

1. [minor] README.md:63 — Deleting setup.yml removes the workflow that created GitHub Release objects; a tag alone provides source archives but does not produce a “source-only Release.” This makes the documented release behavior inaccurate. Clarify that tags expose GitHub-generated source archives, or retain/add a release-creation workflow.

Verdict: Comment — The change is otherwise coherent, but the release documentation should be corrected.