ci: add Castiron promotion workflow

[HAYDEN-OAI]

Summary

• add a default-off workflow_dispatch entrypoint for promoting approved Node Castiron candidates into an exact-tree public next draft PR
• keep the repository workflow thin: it accepts only candidate ID and preflight-contract digest, hardcodes target openai-node, and invokes the pinned shared writer from openai/openai#1138234
• temporarily reuse openai-sdks for a separate checkout token scoped only to openai/openai with Contents read; the later SDK write token remains separately minted and scoped only to openai-node plus openai-node-internal
• serialize promotions per repository and require main/repo guards, a protected castiron-promotion environment, and a repository/org-level CASTIRON_PROMOTION_ENABLED=true gate

This remains intentionally inert: the pin currently points at draft-stack commit 586f788be0094332e6d7f6be3a8195e0356d7dc1. The repository already has CASTIRON_PROMOTION_ENABLED=false plus a castiron-promotion environment restricted to main, requiring sdks-team, and preventing self-review.

Before enabling:

• replace the draft-stack pin with the merged monorepo SHA
• set protected-environment variables CASTIRON_CONTAINER_URI, CASTIRON_AZURE_CLIENT_ID, and CASTIRON_AZURE_TENANT_ID after openai/openai#1143332 is applied
• keep OPENAI_SDKS_APP_PRIVATE_KEY in the protected environment and set repository/org variable CASTIRON_PROMOTION_ENABLED=true only for the controlled first promotion

Validation

• actionlint v1.7.7 .github/workflows/castiron-promote.yml
• Node only: prettier@3.1.1 --check .github/workflows/castiron-promote.yml