feat(vcluster-release): add single release dispatcher action

[sydorovdmytro]

Summary

• Adds a vcluster-release composite action: one entry point for cutting a vCluster release on any supported line, so nobody has to remember which release procedure a version needs.
• Named per-product (vcluster-release, not cut-release) since this shared repo releases multiple products and the action is vcluster-specific (hardcodes loft-sh/vcluster + loft-sh/vcluster-pro and the v0.36 cutover). Leaves room for e.g. platform-release later.
• Routes by numeric (major, minor) compare against the v0.36 cutover: legacy (< v0.36) fans out to both loft-sh/vcluster and loft-sh/vcluster-pro (OSS first); monorepo (>= v0.36) dispatches loft-sh/vcluster-pro only.
• Creates the tag(s) and dispatches each line's own release.yaml via workflow_dispatch (gh workflow run --ref <tag>, which runs the tagged commit's version). The GitHub Release is a pipeline output, not a trigger — so a monorepo-created OSS release can't re-trigger the OSS builder.
• Guards: double-cut (existing tag/release), unprepared/missing branch (distinguishing a real 404 from a transient API error), and a dry-run default that still runs the read-only routing checks.

Test plan

• make test-vcluster-release — 26 bats cases: pure routing (parse_major_minor/derive_line/classify_era incl. numeric v0.9 < v0.36 and v1.0 boundary), legacy dispatch order (OSS before pro), double-cut guards, monorepo main fallback, and the 404-vs-transient distinction (stub mirrors real gh exiting non-zero on 404).
• make lint (actionlint + zizmor, whole repo) clean; make check-docs up to date.
• Verified end-to-end in dry-run against the real repos: legacy v0.35.99 routes OSS→pro; monorepo v0.36.99 falls back to main; the double-cut guard correctly refused a real existing release.

Notes

• The unpinned-uses zizmor finding on the sibling semver-validation reference is expected (internal action pinned by SHA + tag comment per this repo's convention).
• Consumed by a workflow_dispatch button in loft-sh/vcluster-pro (separate PR, held until this merges and vcluster-release/v1 is tagged).

References DEVOPS-1050