release: consolidate tags, PyPI, and GitHub Release behind a blocker gate

[dkropachev]

Problem

MAINTENANCE.md requires a maintainer to create a release commit/tag and atomically push master plus the tag. PyPI publication and GitHub Release creation are separate/manual paths. Once the tag is pushed, a later blocker check cannot prevent the version ref from becoming public.

The current build-push trigger/endsWith condition and manual publishing path should also be reconciled while consolidating the flow.

Required release-process change

• Add a canonical workflow_dispatch flow with version, target branch, and target commit inputs.
• Validate successful CI and version metadata before release.
• Query open release-blocker issues early and immediately before tag push, PyPI upload, and GitHub Release creation.
• Create/push the release commit and annotated tag atomically from the controlled identity.
• Publish wheels through the workflow path registered for PyPI Trusted Publishing, then create the GitHub Release.
• Remove/bound production publication from ordinary branch/tag pushes and the manual upload bypass.
• Protect *-scylla release tags with an active tag ruleset allowing only the release bot/App.
• Update MAINTENANCE.md and recovery instructions.

Operator impact

Maintainers will prepare and merge version changes, then dispatch one workflow. They will no longer push release tags or create GitHub Releases manually. Trusted-publisher configuration may need updating if the canonical workflow filename changes.

Acceptance criteria

• One open release-blocker issue prevents tag, PyPI, and GitHub Release publication.
• Downstream job retries recheck current blocker state.
• API failures fail closed.
• Dry-run builds artifacts without publishing.
• Direct protected release-tag creation is rejected.

[dkropachev]

Tracked by DRIVER-1075.