release: enable maintainer-authorized label promotion

[kovawx]

Summary

Bootstrap the final label-driven release flow onto main.

Included changes

• replace manual workflow dispatch with release:promote PR-label triggering
• require the label sender to have repository role maintain or admin
• keep develop -> main as the only valid release PR direction
• preserve required validate and release-policy checks
• rebuild and revalidate the exact release candidate before a non-force fast-forward
• document the maintainer-only release trigger in both READMEs

Bootstrap note

This PR is the final bootstrap before the label-driven workflow exists on main. After its required checks pass, main will be fast-forwarded to this exact develop commit. Future releases will be triggered only by an authorized maintainer/admin adding release:promote to the reviewed develop -> main PR.