ci: migrate image publish from ECR to GHCR (single-branch release)

[mayankpande88]

Summary

• Deletes dev-ci.yaml and prod-ci.yaml — both pushed to ECR (864186153326... from main, 740395098545... from prod). The prod branch becomes unused under the single-branch policy.
• Rewrites release.yml to publish to GHCR (ghcr.io/nudgebee/node-agent) on v* tags pushed to main. A git merge-base --is-ancestor check fails the build if the tag isn't reachable from main, enforcing the single-branch release policy.
• Replaces deprecated actions/upload-release-asset@v1 + github-script release update with softprops/action-gh-release@v2, which creates the release, attaches both arch binaries, and marks it latest.
• Image tags now include semver {{version}}, {{major}}.{{minor}}, {{major}} (dropped branch/PR tag variants since the workflow only fires on tags now).

Release flow going forward

1. Land changes on main via PR.
2. Tag main with vX.Y.Z and push the tag.
3. Workflow verifies ancestry, builds multi-arch image, pushes to GHCR, creates GitHub release with both binaries.

Test plan

• Merge to main.
• Push a test tag (e.g. v0.0.0-test1) on main and confirm the workflow builds, pushes to ghcr.io/nudgebee/node-agent, and attaches both binaries to the release.
• Push a tag on a non-main branch and confirm the ancestry check fails the build.
• Delete the test tag/release/image after verification.
• Notify any deployers consuming the ECR images (864186153326..., 740395098545...) to switch to ghcr.io/nudgebee/node-agent.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.