Remove legacy release paths and harden the lifecycle

[DariuszPorowski]

Parent: #11777

Implementation plan: PR 18 — Final sweep, last consumers, and hardening

Design: GoReleaser Release Lifecycle

Implementation PR: #12956 (draft; layer 18 of stack #12738).

Scope

Move PR-build container artifacts and main-branch edge publication to GoReleaser snapshot outputs. Remove scripts, Make targets, workflow remnants, and fallback runbook content whose last consumers are gone. Move test-image publication fully into test workflows with immutable test tags, stop release-channel test-image tags, finalize the concise release runbook, and retire standalone post-publication verification.

Acceptance criteria

• One complete release cycle is executed using only the new runbook.
• Repository search finds no callers of removed scripts, targets, or workflows.
• Developer, Bicep, and separate-module test targets remain functional.
• Test images use test-specific immutable tags and no longer publish release-channel aliases.
• The runbook covers only approval, monitoring, resume, and break-glass procedures.
• The implementation PR is linked and merged.