[release] Add release workflows and documentation

[JingsongLi]

What changed

• add a tag-triggered release orchestrator under .github/workflows
• package Java artifacts in separate JDK 8, JDK 11, and JDK 17 jobs
• build PyPaimon sdist/wheel artifacts and publish RCs to TestPyPI or final releases to PyPI
• add release-manager and release-candidate verification guides
• expose both guides in the Project documentation sidebar

Release workflow

• release.yml coordinates Java packaging, PyPaimon packaging, and gated publication
• release-java.yml builds unsigned Java packages with -Dgpg.skip=true and records package manifests and SHA-512 checksums
• release-python.yml validates package versions, builds the sdist and universal wheel, and checks legal files
• release-python-publish.yml publishes RC tags to TestPyPI and final tags to PyPI
• Java GPG signing and Nexus staging remain on the RM machine using the existing JDK-specific scripts
• ASF source archives remain RM-created, signed, and uploaded from the exact RC tag

The Java workflows do not receive GPG keys or Nexus credentials. Only the Python publishing job uses the protected release environment; its required secrets are documented in the release guide.

Validation

• actionlint 1.7.12 on all four new workflows
• Bash syntax validation for workflow run steps and local staging scripts
• ./node_modules/.bin/docusaurus build
• local PyPaimon sdist/wheel build
• python -m twine check
• archive LICENSE/NOTICE content checks
• git diff --check

The Docusaurus build succeeds. It continues to report the repository's existing global broken-link warning for /docs/master/concepts/overview; the new release-document routes and cross-links are generated successfully.