Notify docs when a stable CLI release is published

[llewellyn-sl]

What changed

• add a small release.published workflow
• ignore GitHub prereleases
• mint a repository-scoped token from the existing Docs GitHub App secrets
• send a minimal cli-release-published dispatch to seqeralabs/docs

Why

CLI metadata extraction and documentation generation now belong in the docs repository. tower-cli only needs to announce that a stable release exists; the receiver independently re-fetches and validates the release before doing any work.

Impact

This adds no Java extraction, metadata artifact, source checkout, or generated-file bloat to tower-cli. The workflow depends on DOCS_BOT_APP_ID and DOCS_BOT_APP_PRIVATE_KEY being available to this repository and on the App installation including seqeralabs/docs.

The receiver must merge to the docs default branch before this notifier is merged because GitHub only delivers repository dispatches to workflows present on the target default branch.

Receiver implementation: seqeralabs/docs#1744

Validation

• actionlint .github/workflows/notify-cli-docs.yml
• release payload construction and stable-release condition reviewed against the docs receiver contract