Reduce release latency without weakening release gates

[jeremi]

Summary

Implements the first reviewable slice identified in #427:

• scope CI cancellation to superseded runs of the same pull request
• classify release workflow changes conservatively without triggering unrelated product matrices
• add deterministic, plan-only registry-release prepare and finalize commands
• require explicit release identity and reject version, release ID, and tag reuse
• verify release-image OCI labels with a real Buildx smoke test and fail-closed negative cases
• record binary build duration, Cargo cache results, workflow elapsed time, and completed runner occupancy

The release plans validate the operator-prepared release tree, Crosswalk pin agreement, generated mirrors, candidate lineage, and bounded promotion ref changes. They emit stable machine-readable JSON and do not mutate release surfaces.

Impact

This reduces avoidable CI and release latency while preserving existing release gates and trust-boundary checks. The telemetry artifacts provide the measurements needed for a subsequent before/after release rehearsal.

This intentionally does not define the broader Dependabot release-window policy or public manual/help parity. Those require separate policy decisions and remain follow-up work under #427.

Validation

• python3 -m unittest discover -s release/scripts -p 'test_*.py' (229 tests)
• focused release-plan, workflow, source-model, gate-inventory, and OCI checker tests
• actionlint .github/workflows/ci.yml .github/workflows/release.yml
• shellcheck release/scripts/smoke-release-image-oci-labels.sh
• release manifest, versioned docset, and release-source validation
• real Docker Buildx OCI-label smoke, including invalid-template, missing-label, and wrong-revision failures
• independent final diff review with no findings

Part of #427.

[jeremi]

Follow-up review fixes are now in 90f5c54:

• the non-publishing OCI smoke builds and inspects both Notary and Relay release Dockerfiles
• prepare and finalize use read-only git ls-remote checks for the exact origin tag, so a stale local tag set cannot report a reused version as ready
• unreadable or ambiguous remote tag state fails closed without changing local refs or FETCH_HEAD

Focused verification passed: 82 release unit tests, the real two-image OCI smoke and negative cases, bash syntax, ShellCheck, Actionlint, and diff check.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fedf2ecc98

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".