ci: add reviewable release pull request automation

[BeArchiTek]

Summary

Prepare Backup releases as reviewable pull requests. Merging a release PR publishes a GitHub Release, which starts the existing binary, image, and Homebrew workflow.

Key Changes

• Resolve versions from Git tags; leave the unrelated e2e helper pyproject.toml version unchanged.
• Assemble Towncrier in the release PR, publish only after merge, and add version labels and a label check.
• Keep prerelease Docker images off latest and skip the Homebrew bump for prereleases.
• Add a release-notes docs section and update release guidance.

Test Plan

• actionlint and yamllint on the new workflows
• Label checker positive and negative cases
• git diff --check

---

Assisted-by: opsmill-dev-pr 0.2.0

---

Summary by cubic

Prepares releases as reviewable pull requests instead of publishing directly; merging a bot-authored release PR creates the GitHub Release that runs the existing binary, image, and Homebrew workflow.

• Computes the next version from merged PR labels or an explicit dispatch input, validated against Git tags; an explicit version is required before the first release and the unrelated helper pyproject.toml stays unchanged.
• Assembles the towncrier changelog inside the release PR, with publication gated on the merge and only opsmill-bot-authored release PRs from this repository trusted.
• Requires exactly one changes/major, changes/minor, or changes/patch label on every PR, read from the event payload so PR code cannot weaken the check; bot-authored release PRs are exempt.
• Skips the latest image tag and the Homebrew formula bump for prereleases, and creates releases without the latest flag; a reconciliation job marks the highest stable release as Latest after each publication.
• Adds a per-commit concurrency group to prevent a pending release merge from being replaced by an unrelated push, and a release-notes docs section; AGENTS.md reflects the new fragment policy.
• Moves the label checker into scripts/ for a stable import path and passes PR titles safely to it.

^{Written for commit 3c7a1e1. Summary will update on new commits.}

[cloudflare-workers-and-pages]

Deploying infrahub-ops-cli with    Cloudflare Pages

Latest commit:	3c7a1e1
Status:	✅  Deploy successful!
Preview URL:	https://8a7ee5ec.infrahub-ops-cli.pages.dev
Branch Preview URL:	https://chore-release-pr-automation.infrahub-ops-cli.pages.dev

View logs

[cubic-dev-ai]

All reported issues were addressed across 12 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 9 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>