Release workflow: release branch + downstream reverse-dependency gate

[krystophny]

Implement the upstream release flow from the proposed development model
(itpplasma/code docs/development-model.md). Skeleton:
itpplasma/code docs/templates/upstream-release.yml.

Flow:

1. Cut release/YY.MINOR off main.
2. Dispatch each tracked consumer's integration.yml with libneo_ref=release/YY.MINOR.
3. Poll the runs; gate the tag on all of them passing.
4. Tag YY.MINOR.PATCH at the validated branch head.
5. Open a bump PR in each consumer pinning the tag (never the branch). No auto-merge.

Tracked consumers (inverted find_or_fetch graph): SIMPLE, NEO-2, NEO-RT,
MEPHIT, KAMEL, rabe.

Depends on <DEP>_BRANCH standardized in the consumers and each consumer
carrying integration.yml. Versioning is YY.MINOR.PATCH, tag-derived
(setuptools_scm), no leading zeros.

Acceptance: a manual run cuts the branch, gates on the six consumers, and tags
only when all pass.

[krystophny]

Partially implemented in #278: authoritative blocking list (release/downstreams), advisory drift check (release/check-downstreams.sh), and release.yml that dispatches the blocking downstreams against the release branch. Still TODO here: poll the dispatched runs, enforce the green gate, tag YY.MINOR.PATCH, and open the tag-pinned bump PRs.