chore: add release-plz observation workflow

[tobyhede]

Implements the repository-side portion of CIP-4132.

• adds a release-PR-only release-plz workflow
• uses the repository-scoped GitHub App token
• pins action SHAs and the release-plz CLI version
• preserves bare version tags and disables release-always behavior
• records the release automation ADR and supporting research

This intentionally contains no publishing job. After merge, the generated release PR and its CI run must be observed before CIP-4132 is completed.

Validation:

• actionlint .github/workflows/*.yml
• RUSTC_WRAPPER= cargo check --all-targets --all-features
• RUSTC_WRAPPER= cargo test (28 unit tests, 3 doc tests)

[freshtonic]

Standards

No findings. The change follows the repository’s existing SHA-pinning convention, and no applicable documented standard or maintainability smell is violated.

Spec

No findings. The implementation matches the observation-phase requirements: release-PR-only automation, repository-scoped GitHub App authentication, pinned action and CLI versions, owner guard and release-PR concurrency, bare version tags, release_always = false, and deliberately no publishing job. The ADR and research record the staged rollout and required post-merge observation.

Validation confirmed:

• actionlint passes
• cargo check --all-targets --all-features passes
• cargo test passes: 28 unit tests and 3 doc tests
• all four PR checks are green
• the referenced App variable and secret are provisioned

Approved.