release: fix artifact selection

[katovpn]

Summary

• replace invalid PowerShell Select-Object -Single usage
• require exactly one release executable before generating SBOM and checksum

Safety notes

• release-workflow-only correction; no application or server behavior changes
• the failed tag workflow published no release or assets

Files changed

• .github/workflows/release.yml

Verification performed

• exact artifact-selection and SBOM/checksum block passed locally
• generated reproducible CycloneDX document with five components
• workflow YAML parsed successfully

Approval required

• merge before retrying the failed v0.4.3-preview release