feat: release candidate CI to allow for kokoro signing

[cabljac]

Implements a proper release candidate → final release workflow with signing integration points.

Key Changes

New RC Flow:

• create_rc=true → Creates RC with unsigned binaries (marked as prerelease)
• External signing process (Kokoro) replaces RC binaries with signed versions
• promote_rc=true → Validates signed binaries exist, then promotes to final release

Workflow Safety:

• Validates all expected signed binaries exist before promotion
• Prevents incomplete releases with clear error messages
• Only updates latest tag on final releases, not RCs

Process:

1. Build & test unsigned binaries
2. Create RC → upload unsigned binaries for testing
3. Kokoro signs macOS/Windows binaries, replaces in RC release
4. Promote RC → validates signatures, creates final release

[Copilot]

Pull Request Overview

Implements a new release-candidate workflow with unsigned binaries, integration points for external signing (Kokoro), and a promotion path to final releases.

• Adds create_rc and promote_rc inputs and jobs to the CLI build workflow
• Validates version format before building
• Creates RC releases, waits for signed binaries, then promotes to final releases and updates the latest tag

Comments suppressed due to low confidence (3)

.github/workflows/build-cli-binaries.yml:387

• The uploaded RC asset name omits the file extension. You should include ${{ steps.binary.outputs.ext }} in asset_name so Windows builds get .exe and others keep correct names.

          asset_name: genkit-${{ matrix.target }}

.github/workflows/build-cli-binaries.yml:573

• The final release asset name also omits the extension. Include ${{ steps.binary.outputs.ext }} in asset_name so the correct file names (e.g., .exe) appear in the release.

          asset_name: genkit-${{ matrix.target }}

.github/workflows/build-cli-binaries.yml:479

• This uses the RC tag (inputs.version) for the final release. You should use the derived FINAL_VERSION (without -rc...) for tag_name, release_name, and download URLs to correctly represent the final release.

          tag_name: ${{ inputs.version }}