Resolver for {:github_releases, "owner/repo"} site specs.
The release tag scheme is <package>-v<version>, so multiple packages can
release independently from the same nbpr repository. The asset filename is
the canonical tarball name from NBPR.Artifact.tarball_name/1.
Public release assets only — no auth header. Auth (for private repos and rate-limit avoidance) can be layered on later, mirroring Nerves' GitHub resolver.