ci(release): publish prereleases before qualification

[SDAChess]

Summary

Publish pre-release artifacts before qualification so a flaky qualification run cannot prevent candidate availability. The same Pre-release run calls qualification, fails when a required suite fails, and sends the existing failure notification while published artifacts remain available.

Stacked on #4419; merge the qualification extraction first, then retarget this PR to main.

Related Issue

Direct maintainer request; no tracking issue requested.

Changes

• Split orchestration into Release (build → qualify → publish) and Pre-release (build → publish → qualify), sharing callable build, publication, and qualification workflows. Release Auto-Tag dispatches Pre-release.
• Preserve the existing build steps, package contents, qualification suites, security settings, and stable publication destinations. Codex review serialization is provided by refactor(ci): extract release qualification and serialize Codex reviews #4419.
• Use native job dependencies for failure propagation. Publish passing and failing qualification summaries to Actions and OCI storage.
• Upload installer-visible packages after images and the Helm chart. The pre installer alias accepts published candidates even while qualification runs or after it fails, and retains support for artifacts from the previous workflow.
• Update workflow documentation, contributor guidance, and existing installer/docs workflow tests. Stable artifact promotion and test retries remain outside this change.

Testing

• Actionlint, including ShellCheck, on all seven affected workflows; offline Zizmor reports no high-severity findings.
• Installer regression tests, qualification-summary tests, and all 29 docs website tests pass.
• Local extraction audit verifies unchanged build/publication steps and qualification suites, ordering, tag-mode rejection, failure-notification payloads with a stubbed sender, and summary failure enforcement.
• Docs navigation, Markdown lint, Ruff, skill/crate inventory checks, and git diff --check pass.
• Standalone ShellCheck compared against the parent: no new diagnostics; existing installer/test-harness diagnostics remain.
• No release workflow was dispatched; live publishing and full qualification have not been exercised by these local checks.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture/workflow documentation updated

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4420.docs.buildwithfern.com/openshell