ci(release): promote qualified prereleases to stable #4609

User Story

As an OpenShell maintainer releasing stable versions and supporting previous minor versions, I need Release to promote the latest passing prerelease for the requested version without rerunning qualification or moving shared latest channels backward.

Problem Statement

Release currently accepts an existing stable tag and reruns qualification before publication. Selecting a qualified candidate and tagging its exact commit remain manual, and publishing an older support release can replace shared latest aliases.

Impact / Why This Matters

Stable releases should use recorded prerelease qualification evidence. Parallel release branches must select candidates within their own version and history while preserving the defaults for the newest stable release line.

Proposed Design

Dispatch Release from the intended branch with a stable version. Select the highest-numbered passing prerelease for that version reachable from the selected branch, verify its qualification evidence, tag the exact commit, and build and publish stable artifacts. Older support releases publish versioned artifacts without replacing shared latest channels.

Suggested UX

gh workflow run release.yml --ref release/0.4 -f tag=v0.4.3

Acceptance Criteria

• Promotion requires a successful Pre-release run and matching passing qualification evidence.
• Selection stays within the requested version and selected branch history.
• Stable artifacts are built and published without rerunning qualification.
• Older support releases do not replace shared latest channels.
• Work is delivered in a separate PR stacked on ci(release): decouple prerelease publication from qualification #4420.

Alternatives Considered

Keep manual stable tagging and rerun qualification. This repeats candidate selection and qualification work and leaves support release aliases unprotected. Runtime middleware, providers, and interceptors do not govern release orchestration.

Related: #3559 (security qualification gate), #3632 (artifact promotion versus rebuilding). This implementation rebuilds the qualified source commit with the stable version because release artifacts embed their versions.