fix: auto-trigger CI and Docker publish for release-please PRs

[GraysonCAdams]

Summary

• Add release-pr-checks.yml using pull_request_target to run CI and CodeQL on release-please PRs
• Add workflow_run trigger to docker-publish.yml for automatic Docker image publishing after releases
• Clean up stale TODO comments in release.yml

Problem

release-please uses GITHUB_TOKEN to create PRs and releases. GitHub Actions does not trigger workflows from GITHUB_TOKEN events (to prevent recursive runs). This means:

1. Release PRs had no CI/CodeQL status checks, requiring manual empty commits to trigger them
2. Docker publish didn't fire on release creation, requiring manual workflow_dispatch

Solution

• pull_request_target IS triggered by GITHUB_TOKEN events (it runs in the base branch context). A new workflow uses this to run CI + CodeQL specifically on release-please PRs.
• workflow_run IS triggered by GITHUB_TOKEN workflow completions. Docker publish now watches for the Release workflow to complete and checks if a new version needs publishing.

Test plan

• Next release-please PR should automatically get CI and CodeQL checks
• Next release should automatically trigger Docker image publish
• Manual workflow_dispatch still works as fallback