Add automated release PR workflow

[arjunkomath]

Summary

• add a Release PR workflow that maintains an automated PR from main into release when unreleased commits exist
• derive the next release version from existing vX.Y.Z tags and write it to VERSION in the generated release PR
• tag merged automated release PRs and explicitly dispatch the existing release workflow on that tag
• allow release.yml to be run via workflow_dispatch and serialize per release ref

Verification

• ruby YAML parse for .github/workflows/release.yml and .github/workflows/release-pr.yml
• git diff --check
• smart-reviewed plan and final workflow diff; fixed reported blockers around token dispatch, job concurrency, label permissions, and automation branch force push