ci: add public release finalizer

[sdaveas-circle]

Summary

Adds the public-side release finalizer automation for Arc Node:

• validates merged release PRs before finalization
• creates or updates the public release branch for vX.Y.0 releases
• creates final public release tags
• requires the PR to carry the release label before finalization runs
• chains production final tags into the existing binary and Docker image release workflows
• keeps binary and Docker artifact publishers manually callable from the Actions UI with an explicit tag
• keeps test namespace inputs so this can be exercised against test-main, test-release/*, and test/v* without touching production refs

Safety

• The workflow only runs after PR merge.
• It ignores fork-origin PRs and only finalizes branches from this repository.
• Production defaults target main, release/, and v; test runs can override those through workflow_dispatch.
• Binary and Docker publishing jobs only run when the finalizer resolves the production namespace, so test namespace runs do not publish release artifacts.
• Artifact publishing no longer relies on v* tag-push triggers, avoiding duplicate publishes when the finalizer creates a tag.

Validation

• bash -n .github/scripts/finalize-release.sh
• YAML parse for .github/workflows/*.y*ml and .github/actions/**/*.y*ml
• actionlint .github/workflows/finalize-release.yaml .github/workflows/release-binaries.yaml .github/workflows/build-docker.yaml
• git diff --check
• local finalizer simulation covering validate, finalize, idempotent rerun, and base-advanced merge-race behavior