ci: discover the active release series

[bryanwieg]

What changed

• Discover the newest numeric release/bind-rp series for automatic master-push publication.
• Serialize automatic and manual package releases under one global lock.
• Record the trusted master control commit in schema 4 package channels.
• Require source and control histories to be independently non-decreasing for promotion.
• Retry failed release-asset downloads after removing partial bytes.
• Update publication and rollback documentation.

Root causes

The automatic trigger initially hardcoded 26.7. During the first production run, GitHub reset a release-asset download, and the rerun then showed that BIND-only updates share the release-source commit and need a separate ordered control-plane lineage.

Validation

• 289 CI helper tests passed, plus 3 subtests.
• Python helper compilation passed.
• git diff --check passed.
• Independent review found no remaining Critical or Important code or test issues; the final documentation correction was also verified.