docs(release-management): add ATR (Apache Trusted Releases) runbook

[potiuk]

What

Adds an ATR (Apache Trusted Releases) release runbook as the
counterpart to the existing svnpubsub runbook, so the
release-management docs cover the ATR distribution backend end to end.

New file docs/release-management/atr-release-runbook.md documents the
same 14-step lifecycle, driven by
the same release-* skills, but against the ATR platform. ATR replaces
the mechanics of Steps 5–11 with its three phases:

• Compose (Steps 4–6) — build + sign locally, upload to ATR; ATR
  runs signature/checksum/license/notice/source-header checks on upload.
• Vote (Steps 7–9) — ATR sends the [VOTE] to dev@ and tabulates
  over the ≥72h window; release-vote-tally cross-checks against the
  PMC roster.
• Finish (Steps 10–11) — strips -rcN, publishes to
  dist.apache.org, assists the [ANNOUNCE].

Also included: atr client setup, the two state-change boundaries
(agent never holds the signing key, never publishes) on the ATR
backend, a GitHub Actions/OIDC compose path, and an RM checklist.

Also

• Registers atr as a release_dist_backend value in the adopter
  config template, with an explanatory note.
• Cross-links the new runbook from the family README and the
  svnpubsub runbook.

Notes

• ATR is flagged alpha throughout (alpha deployment
  release-test.apache.org; prod host release.apache.org). The
  svnpubsub runbook remains the ratified default until a PMC ratifies
  ATR; exact atr client verbs are marked "confirm with atr --help"
  since the client schema isn't stable yet.
• Docs-only change. markdownlint, typos, lychee, and doctoc
  all pass.
• Does not yet thread ATR command shapes through process.md's
  backend table or spec.md's per-skill sections — kept proportionate
  to a runbook; happy to follow up if wanted.