ci: harden release automation workflows

[MioYuuIH]

Summary

• require RELEASE_AUTOMATION_TOKEN for release-please so release tags can trigger downstream Docker/bundle workflows
• pin release-please-action to the v4 commit SHA
• restrict promotion workflow branch inputs to develop -> main
• keep changes workflow-only; no docs added

Validation

• yamllint .github/workflows/promote-develop-to-main.yml .github/workflows/release-please.yml
• python3 YAML parse for both workflow files
• git diff --check

Notes

• actionlint is not installed locally, so GitHub Actions expression checks will rely on CI.