fix(ci): auto-trigger CI on release-please PR branch

[mlorentedev]

Summary

• Fixes the recurring issue where release-please PRs have perpetually pending CI checks
• Root cause: GITHUB_TOKEN events don't trigger other workflows, so the CI workflow never runs on the release-please branch
• Solution: the Release workflow now runs tests directly on the release-please branch and reports status checks via the GitHub Statuses API on the correct commit SHA

How it works

1. After release-please creates/updates the PR, a release-pr-ci job runs
2. It checks if the release-please--branches--master branch exists
3. Checks out that branch and runs make check (same as CI workflow)
4. Reports test (3.12) and test (3.13) status checks on the branch HEAD SHA
5. Branch protection sees the checks and allows merge

Test plan

• No code changes — only workflow file
• YAML syntax validated by pre-commit hook
• All ${{ }} expressions use env vars to prevent injection (GitHub Actions security best practice)