ci: simplify to develop + release branches, remove main branch

[axelander]

Summary

Introduces a structured release flow using persistent release/v1.X branches. Previously, all work happened on develop and main. Now releases go through a dedicated branch with RC
tags for testing before final release.

Flow:
feature/* → develop → release/v1.X → RC tags (testing) → release tags (production)

Key changes

• Remove main from all workflow triggers — main is no longer part of the release flow
• Remove develop branch push builds from PR target branches where not needed
• Image builds only via tags — no branch push builds except develop; testing is done by creating RC tags (v1.8.0-rc.1) via GitHub Releases UI
• Add tag-branch validation — the build workflow fails if a v1.X.* tag is not on the correct release/v1.X branch, preventing accidental mis-targeting
• Fix pr_lint diff base — was hardcoded to origin/main, now uses origin/${{ github.base_ref }} to correctly diff against the PR's actual target branch
• Rewrite deployment workflow docs — full rewrite of DEPLOYMENT_WORKFLOW.md covering the new flow, including hotfix, backporting, security patches, and cherry-pick-to-develop
  guidance

How releases work

1. Create release/v1.X branch from develop
2. Tag v1.X.0-rc.1 via GitHub Releases UI (mark as pre-release) → builds image → deploy to test
3. Fix issues on release branch, create more RCs as needed
4. Tag v1.X.0 (final release) → builds production image
5. Cherry-pick any release branch fixes back to develop

Hotfixes

1. Create hotfix/* branch from the affected release/v1.X
2. PR to release branch, merge
3. Tag new patch version via GitHub Releases UI
4. Cherry-pick fix to develop