Fix release and promotion for NI protected branches

[elijah286]

Summary

• Fix the release failure caused by NI branch protection rejecting the Actions bot's direct catalog push (GH013: changes must be made through a pull request).
• On that explicit rejection, release and promotion push a dedicated lvci-release/ branch and open a reviewable catalog PR. Authentication and unrelated rule failures remain errors; publication is deferred.
• After merging a trusted bot-created catalog-only PR, Release publishes the prepared version without another bump. No branch protection is changed and no PR is auto-approved or auto-merged.
• Update both byte-identical documentation copies with operation and recovery instructions.

Validation

• 14 focused unit tests passed (protected push, PR reuse, creation failure, trusted merge resume, history invariant, normal merge routing).
• actionlint passed for both workflows.
• Catalog/source sync and git diff --check passed.
• Both documentation copies have identical SHA256 hashes.

Rollout

1. Obtain required code-owner approval and merge this PR. The repository already permits Actions to create PRs; organization policy must continue allowing it.
2. Release should open a prepared catalog PR. Review and merge it; if no Release run starts, dispatch Release on main immediately after that merge.
3. Verify the immutable NI-source release is published, then dispatch Promote release for that version with tier=stable.
4. Review and merge the promotion catalog PR; let Release publish it (or dispatch it on main immediately after merge), then verify the live installer selects the NI-source stable release.

The original link migration is already on main as b1fbd53. This PR addresses the remaining release automation blocker. It does not publish or promote a release itself.