[kwsantiago]

Adds release-blake2b.yml, which builds a release from a vX.Y.Z-blake2b.N tag. The upstream release workflow never runs here: its tag patterns do not match these tags, and it publishes Docker images and PyPI packages and signs in CI with a stored key.

On a tag push it:

• checks the tag's format, that it points at the pushed commit, and that the commit is on blake2b-unified;
• builds the reproducible Ubuntu 22.04, 24.04 and 26.04 tarballs, amd64 on ubuntu-24.04 and arm64 natively on ubuntu-24.04-arm, with the same contrib/reprobuild images and tools/build-release.sh as upstream;
• sets the tarballs' file dates to the tagged commit's date in UTC, as the previous releases did, so anyone can rebuild them from the tag alone;
• writes one SHA256SUMS-<tag> over exactly the six tarballs;
• in a separate job, the only one with a write token, drafts the release with the six tarballs, SHA256SUMS-<tag> and privkeyio-signing-key.asc (now contrib/keys/privkeyio.txt), refusing if a release for the tag already exists.

Nothing is signed in CI. The release captain rebuilds, compares checksums, signs SHA256SUMS-<tag>, uploads the .asc, writes the notes and publishes the draft.

workflow_dispatch builds an existing tag's commit, and drafts only when create_release is set. A pull request that touches the workflow or the reproducible build scripts builds all six tarballs from its merge commit without drafting.

Changelog-None