ci(release): sweep accumulated dryrun prerelease tags

[joshua-temple]

What

Closes #388. Adds a decoupled sweep-dryrun-tags job to nightly-release.yaml that prunes accumulated -dryrun.N tags and their prereleases, keeping the newest few.

Why not inline

The dryrun tag is the load-bearing carrier across workflow_run boundaries: Release builds it, Fleet E2E validates it, and Auto-promote's rc-only gate rejects it. The nightly dispatch job finishes long before that chain completes, so an inline delete would tear the rehearsal down before it runs. The sweep is therefore decoupled and retention-based.

Safety

• Deletes ONLY tags matching ^v[0-9]+\.[0-9]+\.[0-9]+-dryrun\.[0-9]+$ (anchored). Verified to reject v0.6.0 (release), v0.6.0-rc.4 (rc), and mixed shapes.
• Keeps the newest RETENTION=3 (an in-flight rehearsal is always among the newest), prunes older ones plus their GoReleaser prereleases (gh release delete --cleanup-tag, falling back to git push --delete).
• Idempotent (at/under retention is a no-op); gated so it never races a freshly cut tag.
• Regex-filtered at enumeration, then re-asserted per candidate before delete.

Verification

actionlint clean; shellcheck passed on the run block; uses the default GITHUB_TOKEN with contents: write (no new secret).

Pairs with #410 (the version-calc fix); this reduces the accumulation, #410 makes the calc robust regardless.