After a successful windows-cross build on main or v* tags, upload the zip and .sha256 via scripts/release_windows.sh (creates/updates v$VERSION). Prefer secrets.RELEASE_TOKEN; fall back to GITHUB_TOKEN. Skip on PRs.