fix(ci): wait for ci-release-publish before ci-network-scenario

[AztecBot]

Summary

ci-network-scenario raced ci-release-publish on nightly tag runs: the
scenarios pulled aztecprotocol/aztec:<tag> from Docker Hub before that
image had been pushed, so the latest nightly failed.

Example: run 25710972450
(v5.0.0-nightly.20260512) — scenarios started at 03:17 and failed by 03:35,
while ci-release-publish only finished at 03:44.

The proposed workflow change lives at .github-new/workflows/ci3.yml
because this session was not started with ci-allow. To land, copy it over
.github/workflows/ci3.yml in a follow-up commit (or re-run with ci-allow).

Fix

Add ci-release-publish to ci-network-scenario's needs, and gate on
its result being success or skipped:

• Nightly tag → ci-release-publish runs and must succeed before
  scenarios start.
• PR with ci-network-scenario label → ci-release-publish is skipped
  (its if: requires a tag), and the scenario job builds + pushes to
  aztecdev itself, so the skipped branch keeps the gate happy.
• If ci-release-publish fails on a nightly, scenarios are now skipped
  rather than failing with a Docker pull error.

No cycle: ci-network-scenario → ci-release-publish → [ci, ci-compat-e2e] → ci.

Details: https://gist.github.com/AztecBot/040284e4d65a4f5161d430eecbc9ac1a

Test plan

• Promote .github-new/workflows/ci3.yml to .github/workflows/ci3.yml.
• Next nightly tag triggers ci-release-publish first; ci-network-scenario
  starts only after the image is on Docker Hub.
• A PR with the ci-network-scenario label still runs scenarios as
  before (label-driven path: ci-release-publish is skipped).

ClaudeBox log: https://claudebox.work/s/af8eefbd781c1674?run=1