ci(core,rest): trigger release builds on tags only, not release/* branches (#2622)

## Summary
- Remove `release/*` from `on.push.branches` in both `ci.yaml` (Core)
and `rest-ci.yml` (REST) so that pushes to release branches no longer
trigger full CI runs
- Release CI is now triggered exclusively by version tags (`v*`) which
already exist in the `on.push.tags` globs
- Add `refs/tags/` to the `notify-build-status` condition in `ci.yaml`
so tag-triggered release builds still send Slack notifications

Closes #2340

## Test plan
- [ ] Push a commit to a `release/*` branch — CI should **not** trigger
- [ ] Push a `v*` tag on a release branch — both Core and REST CI should
trigger via the existing `on.push.tags` globs
- [ ] Verify `notify-build-status` fires on a tag-triggered build (check
Slack notification)
- [ ] Verify `main` and `pull-request/*` push triggers are unaffected

Author: lachen-nv

.github/workflows/ci.yaml

@@ -20,7 +20,6 @@ on:
   push:
     branches:
       - main
-      - release/*
       - "pull-request/[0-9]+"
     tags:
       - "v[0-9]*.[0-9]*.[0-9]*"
@@ -1407,7 +1406,7 @@ jobs:
   # ============================================================================
 
   notify-build-status:
-    if: ${{ always() && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')) && github.event_name != 'schedule' }}
+    if: ${{ always() && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/') || startsWith(github.ref, 'refs/tags/')) && github.event_name != 'schedule' }}
     needs:
       - prepare
       - build-container-x86_64

.github/workflows/rest-ci.yml

@@ -8,7 +8,6 @@ on:
   push:
     branches:
       - main
-      - release/*
       - 'pull-request/[0-9]+'
     tags:
       - "v[0-9]*.[0-9]*.[0-9]*"