ci(release): stop release-please branch recursion

[dc-tec]

Summary

• Excludes release-please--branches--* from the Release Please PR and Release Tag push triggers.
• Adds a push-time guard that skips release-please when a push only changes release artifact files: CHANGELOG.md, .release-please-manifest.json, and charts/openbao-operator/Chart.yaml.
• Keeps workflow_dispatch and empty Release-As: marker commits working because the guard only skips non-empty release-artifact-only pushes.

Related Issues

Follow-up to the recursive release-please PR loop that created #450-#455 from #395.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactor (code improvement/cleanup)
• CI, release, or build tooling
• Other maintenance

Risk and Compatibility

Release workflow only. This prevents recursive release-please runs on release-please head branches and avoids opening a new release PR from release-artifact-only merge commits. Manual Release-As dispatches and normal code/documentation changes still run release-please.

Verification

• ./bin/actionlint .github/workflows/*.yml
• git diff --check
• make lint-ci via the pre-push hook.
• Confirmed the recursive PRs chore(release-please--branches--main): release 0.1.0 #450-chore(release-please--branches--release-please--branches--release-please--branches--release-please--branches--release-please--branches--release-please--branches--main): release 0.3.0 #455 were closed, their nested branches were deleted, and no active Release Please PR runs remained before opening this PR.

Reviewer Notes

The active main release PR #395 and its branch release-please--branches--main were intentionally left intact.

Checklist

• My code follows the project style guide.
• I have performed a self-review of my own code.
• I have added or updated tests, or explained why tests are not needed.
• I have updated documentation, or explained why docs are not needed.
• I have updated generated artifacts, or confirmed none are affected.
• I have checked that this change does not log or expose secrets, tokens, credentials, keys, or raw Secret data.
• I have run the relevant local checks, or documented why they were not run.
• Any dependent changes have been merged, published, or clearly called out.