ci(release): infer optional workflow tags

[SDAChess]

Summary

Allow maintainers to dispatch Pre-release and Release with only a branch. Pre-release creates the next candidate in that branch's seeded series; Release detects its highest prerelease version and promotes a qualified candidate from the same history. Explicit tags remain available for overrides and retries.

Related Issue

Related to #4609. Builds on #4611, which is merged; this PR targets main.

Changes

• Make both workflow tag inputs optional and propagate resolved tags and source commits through the jobs and promotion records.
• Require an explicit -pre.1 seed for each new version series. Stop automatic selection for an already stable version; Release also stops when the inferred version has no qualified candidate.
• Share branch-scoped candidate numbering with Release Auto-Tag, account for repository-wide tag collisions, and serialize tag creation. Preserve scheduled skips for unchanged commits and inactive series.
• Document support-branch dispatches, explicit retries, and the requirement that support branches contain the updated workflow definitions.

Testing

• Rebased the two PR-specific commits onto current main; preserved release-notes preview guidance when resolving the CI.md conflict. Re-ran Ruff, Actionlint with ShellCheck, offline Zizmor, and git diff --check, plus 17 disposable Git-history checks with mocked GitHub calls.
• Ruff lint and formatting, Actionlint with ShellCheck, offline Zizmor, and git diff --check pass. Actionlint's unsupported queue: max diagnostic is excluded explicitly.
• Disposable Git-history checks cover numeric ordering, branch isolation, shared-series tag collisions, seed requirements, scheduled skips, inferred promotion, missing qualification, explicit stable retries, and support-release latest-channel protection.
• Execute the tag-resolution shell locally with captured API calls to verify automatic creation, explicit tags, tag-push triggers, source pinning, invalid inputs, and collision failure.
• No release suites or workflows were dispatched. Tag creation and publication against GitHub remain unverified; no repository tests were added.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• CI and contributor guidance updated

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4707.docs.buildwithfern.com/openshell