ci: adopt consolidated ospo-reusable-workflows release.yaml

[jmeridth]

Pull Request

Proposed Changes

Collapse the three legacy release / release_image / release_discussion job calls plus the bespoke update_major_tag job into a single call to the consolidated release.yaml reusable workflow at v1.0.0 (592067a6...). The new workflow handles GitHub release creation, container image build/push to GHCR, build provenance attestation, the announcement discussion, and pushing the major-version moving tag, in one draft-first pipeline.

Also add a "💥 Breaking Changes" category to release-drafter.yml, matching the upstream release-drafter template (github-community-projects/ospo-reusable-workflows#134). The breaking label was already wired up under version-resolver.major, so this just surfaces those PRs in their own changelog section.

Notes for reviewers

• The reusable workflow's create_release tags both the full version (e.g. v1.2.3) and the short/major moving tag (e.g. v1) and force-pushes both. The deleted update_major_tag job did exactly that for the major tag, so behavior is preserved — but worth a careful look at the next release to confirm the major tag does move as expected.
• image-name is preserved as ${{ github.repository_owner }}/stale_repos (underscore form) so the published image at ghcr.io/github-community-projects/stale_repos stays at the exact same path as before.
• The job-level permission block now lists the union of what the called workflow's internal jobs need. A uses: caller can only grant — never expand — what the reusable workflow requests, so missing perms here silently disable features instead of erroring.
• image-registry / image-registry-username moved from secrets: to inputs in v1.0.0 and default to ghcr.io / github.actor. Both defaults match the previous values, so the inputs are omitted.
• image-registry-password stays a secret and continues using GITHUB_TOKEN for GHCR pushes.

Readiness Checklist

Author/Contributor

• If documentation is needed for this change, has that been included in this pull request
• run make lint and fix any issues that you have introduced
• run make test and ensure you have test coverage for the lines you are introducing

Testing

• make lint — clean (mypy 0 issues across 10 source files, black 10 files unchanged).
• make test — 41 tests + 6 subtests pass, coverage 89.81%.
• npx prettier --check .github/workflows/release.yml .github/release-drafter.yml — clean (super-linter runs prettier on YAML).
• End-to-end release flow is not exercised locally; first real validation will be the next merged PR carrying a feature / fix / breaking / vuln / release label that fires pull_request_target: closed. Watch for: draft release created by release-drafter, full + short tags both pushed by create_release, container image published to ghcr.io/$OWNER/stale_repos, build provenance attestation succeeding, release announcement discussion created (if RELEASE_DISCUSSION_* secrets are set), then publish_release flipping the draft to published.