ci: move release flow into a GitHub Actions workflow (#2417)
## Summary
- `release.sh` is reduced to a thin dispatcher: validates the semver,
checks the operator is on a clean local `main` in sync with
`origin/main`, then `gh workflow run release.yaml -f version=$1`.
Tag-existence pre-check lives in the workflow itself, not the
dispatcher.
- New `.github/workflows/release.yaml` does the work end-to-end: refresh
PGO profile, bump the Caddy module's `frankenphp` dependency + `go mod
tidy`, commit + tag via the GitHub REST API (Verified,
`github-actions[bot]`), draft the release with correct previous-tag
detection (handles back-ports and first releases), trigger the static /
docker / windows builds explicitly (GITHUB_TOKEN-driven API writes don't
fire tag/push workflows), and bump the Homebrew formula.
- The release commit message is tagged `[skip ci]` as a defensive
belt-and-suspenders so any future switch to PAT-driven pushes doesn't
double-trigger downstream builds.
- `.github/workflows/pgo-profile.yaml` is removed; its job is folded
into the release workflow so every release commit carries a fresh
profile.
- `.gitignore` ignores `profiles/regular.pgo` and `profiles/worker.pgo`
intermediates.
## Pre-reqs before first dispatch
- Create a `release` GitHub Environment.
- Provision `HOMEBREW_TOKEN`: PAT with write access to
`dunglas/homebrew-frankenphp`. `GITHUB_TOKEN` covers everything else
(commit/tag via REST API, draft release, downstream dispatches).
