Add Temporal-backed release automation

[eamsden]

What changed?

• Automate release with one Temporal workflow implemented in Python.
• Start and complete a release from the GitHub Actions run triggered when an SDK owner merges one valid release-note file.
• Build the fixed native matrix and signed Maven payload, freeze their GitHub Actions artifact identities in Workflow state, publish Maven with bounded ambiguity recovery, then create the GitHub draft, attach assets, and make it public.
• Keep release- and Maven-generation-specific task queues, GitHub App publication authentication, global publication concurrency, and credential-free candidate compilation.
• Remove timers, separate approval and ownership workflows, manual takeover and recovery UI, and the former manual release workflow.

Why?

The current manu-matic Java release process contains footguns which have led to incidents. There is also enough fragility in the GitHub and Maven release process that dogfooding Temporal here seems reasonable. The Python implementation keeps the necessary orchestration and reconciliation in one readable operational path.

Breaking changes?

No SDK API changes.

The former manual prepare-release path is intentionally removed. Merging a valid release-note file is the release authorization and execution trigger.

Verification

• 8 focused local tests using the Temporal ephemeral test server and mocked publication activities
• Ruff formatting and lint
• Strict mypy
• uv lock consistency
• Shell syntax and deterministic native/Maven archive smoke checks
• Workflow YAML parsing, pinned Action validation, and permission-boundary checks
• No scheduled or manual dispatch entrypoint in the Temporal release workflow

No release, test release, Maven publication, tag, GitHub release, or external Temporal operation was run while developing or testing this change.

Server PR

None.

Supersedes #2986.