fix(ci): wait for ci-release-publish before ci-network-scenario (#23169)

## Summary

`ci-network-scenario` raced `ci-release-publish` on nightly tag runs:
the
scenarios pulled `aztecprotocol/aztec:<tag>` from Docker Hub before that
image had been pushed, so the latest nightly failed.

Example: [run
25710972450](https://github.com/AztecProtocol/aztec-packages/actions/runs/25710972450)
(`v5.0.0-nightly.20260512`) — scenarios started at 03:17 and failed by
03:35,
while `ci-release-publish` only finished at 03:44.

The proposed workflow change lives at `.github-new/workflows/ci3.yml`
because this session was not started with `ci-allow`. To land, copy it
over
`.github/workflows/ci3.yml` in a follow-up commit (or re-run with
`ci-allow`).

## Fix

Add `ci-release-publish` to `ci-network-scenario`'s `needs`, and gate on
its result being `success` or `skipped`:

- Nightly tag → `ci-release-publish` runs and must succeed before
  scenarios start.
- PR with `ci-network-scenario` label → `ci-release-publish` is skipped
  (its `if:` requires a tag), and the scenario job builds + pushes to
  `aztecdev` itself, so the `skipped` branch keeps the gate happy.
- If `ci-release-publish` fails on a nightly, scenarios are now skipped
  rather than failing with a Docker pull error.

No cycle: `ci-network-scenario → ci-release-publish → [ci,
ci-compat-e2e] → ci`.

Details:
https://gist.github.com/AztecBot/040284e4d65a4f5161d430eecbc9ac1a

## Test plan

- [ ] Promote `.github-new/workflows/ci3.yml` to
`.github/workflows/ci3.yml`.
- [ ] Next nightly tag triggers `ci-release-publish` first;
`ci-network-scenario`
  starts only after the image is on Docker Hub.
- [ ] A PR with the `ci-network-scenario` label still runs scenarios as
  before (label-driven path: `ci-release-publish` is skipped).

ClaudeBox log: https://claudebox.work/s/af8eefbd781c1674?run=1

Author: alexghr

.github/workflows/ci3.yml

@@ -196,10 +196,11 @@ jobs:
       matrix:
         test_set: ["1", "2"]
     # We run on current nightly tags only, or when the ci-network-scenario label is present in a PR.
-    needs: [ci, validate-nightly-tag]
+    needs: [ci, validate-nightly-tag, ci-release-publish]
     if: |
       always()
       && (needs.ci.result == 'success' || needs.ci.result == 'skipped')
+      && (needs.ci-release-publish.result == 'success' || needs.ci-release-publish.result == 'skipped')
       && github.event.pull_request.head.repo.fork != true
       && github.event.pull_request.draft == false
       && (