feat(release): implement trunk-based CI/CD pipeline

[JSisques]

Summary

Implements the design proposed in #72: trunk-ci-cd.yml (continuous build, commit-addressed tags, sequenced deploy-dev → deploy-pre) and a new bump_mode: promote in docker-release.yml that retags an already-validated digest instead of rebuilding from source, so a prod release ships byte-for-byte what passed pre.

Purely additive: release-train.yml and the existing legacy/release-train bump modes are untouched. release-train-detect's regression suite still passes (36/36). actionlint is clean on both changed workflow files.

deploy-dev/deploy-pre are placeholder steps — no consuming repo has real dev/pre infrastructure yet (see design.md D4); the job graph and ordering are the deliverable here.

Chain Context

Field	Value
Chain	trunk-based-ci-cd
Tracker PR	#72 (design/proposal)
Position	2 of 2 (planned)
Base	docs/trunk-based-ci-cd-design
Depends on	#72
Follow-up	beacon-api pilot migration (separate repo, separate change)
Review budget	392 / 400
Starts at	docs/trunk-based-ci-cd-design (design merged into this branch)
Ends with	trunk-ci-cd.yml + docker-release.yml promote mode ready for a pilot repo to consume

Chain Overview

main
 └── #72 docs(release): propose trunk-based CI/CD design
      └── 📍 This PR: feat(release): implement trunk-based CI/CD pipeline

Scope

• Includes: trunk-ci-cd.yml, docker-release.yml bump_mode: promote, README docs, tasks.md progress
• Excludes: real deploy implementations for dev/pre/prod (no infra yet), migrating any consuming repo's own workflows, deprecating release-train.yml

Autonomy

• CI is expected to pass for this PR branch
• This PR has one deliverable scope
• This PR can be rolled back without unrelated changes
• Multi-arch imagetools create promotion is flagged but not yet dry-run validated (tasks.md 2.4/2.5, 4.2)

Test plan

• actionlint clean on trunk-ci-cd.yml and docker-release.yml
• tests/release-train-detect.test.sh — 36/36 passing, no regression
• Dry-run trunk-ci-cd.yml end-to-end against a disposable repo (tasks.md 4.1)
• Dry-run docker-release.yml bump_mode: promote against a real multi-arch image (tasks.md 4.2)