feat(release): publish Python, desktop, and containers together

[tulayha]

Summary

• replace separate Python, desktop, and container publication paths with one combined version, candidate, and GitHub release
• validate the exact Release Please PR head before merge, then publish the retained packages, installers, and immutable container digests without rebuilding
• publish unique non-documentation main builds to TestPyPI while keeping beta and stable releases on PyPI
• prepend a concise product-facing download and installation section to every GitHub release before the generated changelog
• add stable validation/required and release/candidate merge gates without path-filter deadlocks or duplicate Release Please builds
• make Cargo.lock version updates regeneration-safe through a package-targeted TOML updater

Why

The previous release paths could drift, rebuild the same product independently, or discover packaging failures only after the release PR had merged. The combined flow proves the exact release tree before merge and keeps a failed publication recoverable from the same candidate artifacts.

Release behavior

• main produces beta releases; release produces stable releases.
• Release Please maintains one combined version across Python, desktop, and containers.
• release/candidate is immediately successful for ordinary PRs and remains pending on Release Please PRs until the complete candidate succeeds.
• Publication verifies candidate/tag tree identity, resumes matching PyPI and container work, uploads one checksum set, and publishes the existing draft GitHub release only after every component succeeds.
• The editable release-page introduction lives in .github/release-intro.md; rendered notes preserve Release Please changes and remain idempotent on retries.

CI behavior

• validation/required always reports on PRs and aggregates only the checks applicable to the centralized scope decision.
• documentation-only changes skip heavy builds without losing the required aggregate status.
• Release Please PRs defer normal duplicate builds to release/candidate; main to release promotion does not rebuild already validated main.
• new, unknown code roots default to full validation rather than silently bypassing a stale path list.
• Desktop is invoked as a reusable workflow by CI instead of maintaining a second PR path filter.
• Cargo may regenerate Cargo.lock normally; Release Please targets only the vidxp-desktop lock entry, and packaging tests verify its version.
• GitHub cache actions use v6 while the valid Rust 1.97.1 toolchain pin remains unchanged.

Validation

• Actionlint 1.7.12 with ShellCheck 0.11.0
• focused release-version and CI-scope contracts
• uv lock --check
• Ruff and whitespace checks
• 72 locked Rust tests
• Release Please Cargo.lock updater exercised against the repository lockfile

Rollout after merge

No repository rules are changed by this PR. After merge, observe these statuses on a refreshed PR and require validation/required, dependency-review, and release/candidate on main, with branches required to be up to date. Promote the workflow baseline to release, then apply the same requirements there.