Add latest-only release workflow

[ianpittwood]

Summary

Adds .github/workflows/release.yml — a workflow_dispatch-only workflow that replaces (rather than supplements) the Workbench version of every managed image and opens a PR against main.

• Same-edition patches use bakery update version --target-version to preserve pinned dependency versions (R / Python / Quarto).
• Edition bumps use bakery create version + bakery remove version, allowing fresh dependency resolution per dependencyConstraints.
• Three-pass README sync (OLD_TAG → TAG_VERSION, then display, then edition-conditional) keeps published version references in step with bakery.yaml.
• PR is authored via a GitHub App token so downstream PR workflows (Lint, Production, Zizmor) trigger normally.
• Security pattern matches the reference shared workflow: no ${{ }} expressions inside any run: block; all values flow through env:.

Configuration required before first run

The repository must have these secrets configured (reuse the existing images-workbench App or provision a new one):

• APP_ID
• APP_PRIVATE_KEY

Test plan

The workflow cannot be invoked from a non-default branch until it merges, so smoke-testing happens after merge:

• No-op run — trigger with the version currently pinned in bakery.yaml (gh workflow run release.yml -f version="$(bakery get version workbench-for-google-cloud-workstations)"). Expect: capture step reports "Nothing to do." and all later steps skip.
• Same-edition patch — trigger with a bumped build identifier in the same edition (e.g. 2026.04.0+526.pro3). Expect: bakery update version branch runs; PR body says "Same-edition patch: dependency pins preserved".
• Edition bump — trigger with the next edition (e.g. 2026.05.0+...). Expect: bakery create + bakery remove branch runs; PR body says "Edition bump: dependencies re-resolved".