ci(release): split channel pipelines and automate version transitions (#345)

* ci(release): split channel pipelines and automate version transitions

Introduce dedicated next/release orchestration workflows backed by a reusable publish pipeline with RC/final package version updates and post-release main dev bump PRs. Add a strict release process SOP with RC freeze, hotfix override, and mandatory backport rules.

* ci(release): gate main-to-next promotion on green CI

Add a dedicated workflow that validates main branch checks/statuses and block the promote-main-to-next flow unless main is green. Update the release SOP to reflect the enforced pre-promotion validation.

* ci(release): fix channel promotion edge cases and policy gaps

Switch channel promotions to reset-based snapshots with force-with-lease pushes, stop auto-merging channel nix-refresh PRs, and guard main dev bump against version downgrades. Add RC changelog fallback, require AUR release updates in SOP, and extend npmDepsHash sync to main/next/release pushes.

* docs(release): clarify backport and nix refresh survivability rules

Require RC fix backports to reach main before the next main-to-next promotion, and document that channel-local nix refresh PRs are advisory unless equivalent changes are merged into main.

.github/workflows/nix-npm-deps-hash-sync.yml

@@ -2,12 +2,12 @@
 # Runs in CI with Nix — contributors do not need Nix locally.
 #
 # Skips fork PRs (cannot push to the contributor branch); after merge to main,
-# the push workflow updates the hash on main if needed.
+# next, or release, the push workflow updates the hash on that branch if needed.
 name: Sync Nix npmDepsHash
 
 on:
   push:
-    branches: [main]
+    branches: [main, next, release]
     paths:
       - package-lock.json
       - package.json