ci: add public release finalizer

[sdaveas-circle]

Summary

Adds the public-side release finalizer automation for Arc Node:

• validates merged release PRs before finalization
• creates or updates the public release branch for vX.Y.0 releases
• creates final public release tags
• requires the PR to carry the release label before finalization runs
• chains production final tags into the existing binary and Docker image release workflows
• keeps binary and Docker artifact publishers manually callable from the Actions UI with an explicit tag
• keeps test namespace inputs aligned with the private release suite so this can be exercised against test-main, test-release/*, and test-v* without touching production refs
• accepts legacy test/v* test tags while standardizing new test runs on test-v*

Safety

• The workflow only finalizes after PR merge.
• It ignores fork-origin PRs and only finalizes branches from this repository.
• It only accepts sync/* Copybara branches with Git-valid branch names, matching the private handoff output such as sync/v0_8_0 and sync/test-v0_8_0.
• Production defaults target main, release/, and v; test namespace runs target test-main, test-release/, and test-v.
• Binary and Docker publishing jobs only run when the finalizer resolves the production namespace, so test namespace runs do not publish release artifacts.
• Artifact publishing no longer relies on v* tag-push triggers, avoiding duplicate publishes when the finalizer creates a tag.

Validation

• bash -n .github/scripts/finalize-release.sh scripts/release-config.sh
• actionlint .github/workflows/finalize-release.yaml .github/workflows/release-binaries.yaml .github/workflows/build-docker.yaml
• git diff --check
• Docker tag helper smoke test for v0.8.0, test-v0.8.0, test/v0.8.0, and dev-v1.2.3-rc1
• public finalizer validation smoke for test-v0.8.1, legacy test/v0.8.1, and old sync/copybara-export-* branch shape
• invalid Copybara branch rejection smoke for sync/bad..branch