ci: harden WordPress sync to prevent missed nightly/release updates

[Orinks]

Summary

• switch WordPress sync calls to a local reusable workflow (./.github/workflows/push-releases.yml) instead of external @master
• add workflow_dispatch to update-wordpress.yml so sync can be run manually when needed
• add reusable push-releases.yml with:
  • required secret validation (WP_PUSH_TOKEN, WP_SITE_URL)
  • 10-minute timeout
  • single retry on transient failure
  • optional cache nudge path (/wp-json/ogr/v1/bust-cache) before retry via bust_cache_first input
• make build.yml invoke WP sync only when release actually succeeds (needs.release.result == 'success')

Why this prevents nightly/release misses

• removes dependency drift/failures from external workflow refs
• ensures failed first push gets one controlled retry
• allows manual fallback runs from Actions UI if release event delivery is delayed/missed
• ties build-triggered sync to release success explicitly, preventing skipped/invalid WP sync steps

Validation

• gh workflow list --limit 20
• gh workflow view "Build"
• gh workflow view "Update WordPress on release"
• basic integrity check for changed YAML files (whitespace/format check)