ci: automate release candidate staging

[chaokunyang]

Why?

Fory release candidates currently require local source and JVM staging. Issue
#3981 proposed following Pekko's CI release flow, and INFRA-28319 requests the
repository secrets needed for Fory's signing key and Apache Nexus deployer.

What does this PR do?

• adds a manually dispatched workflow for immutable vX.Y.Z-rcN tags
• builds the existing source release and uploads it to ATR through GitHub OIDC
• publishes JVM artifacts to Nexus, discovers only repositories created by the
  run, closes them together, and verifies anonymous artifact downloads
• validates all release versions before either publishing job starts and
  serializes staging so Nexus repository ownership is unambiguous
• makes CI the default fory-release path while retaining manual publication
  only when explicitly requested
• keeps release verification in fory-release; no duplicate release-verify
  skill is added

Related issues

• Refs Automate the release? #3981
• https://issues.apache.org/jira/browse/INFRA-28319

Does this PR introduce any user-facing change?

• Does this PR introduce any public API change?
• Does this PR introduce any binary protocol compatibility change?

Benchmark

N/A. This change does not touch runtime code.

[chaokunyang]

Waiting for https://issues.apache.org/jira/browse/INFRA-28319