Port release workflows and scripts from main to 3.x

[joelhawksley]

Brings 3.x in line with main's automated release pipeline so 3.x maintenance releases can be cut via workflow_dispatch instead of relying on a maintainer running scripts locally.

Supersedes #2704 (which only fixed the deprecation-horizon sed).

Ported from main

• .github/workflows/release.yml — workflow_dispatch that runs script/release with major/minor/patch inputs and opens a release PR.
• .github/workflows/publish-release.yml — triggers on push to 3.x (or manual dispatch) and runs script/publish.
• .github/workflows/push_gem.yml — pushes the tagged gem to RubyGems via Trusted Publishing.
• script/release — includes every fix that landed on main:
  • DEPRECATION_HORIZON sed handling the quoted string form.
  • main "$@" so workflow args reach main().
  • BUNDLE_FROZEN=false / BUNDLE_DEPLOYMENT=false for the release run.
  • Lockfile updates via sed (avoids bundle lock cross-Ruby lockfile mismatches on rails_main_head, once such appraisals are added).
  • Force-push and idempotent PR creation for retry safety.
  • Hard-fail if sync_contributors.rb or rake docs:build fails.
• script/publish — includes all main fixes:
  • GITHUB_TOKEN-compatible permission probe (skips in Actions).
  • Explicit gh workflow run push_gem.yml --ref $tag after gh release create (the tag push from GITHUB_TOKEN does not fire downstream workflows).
• script/sync_contributors.rb — used by build_docs on main; brought over so the docs task is consistent.

3.x-specific adjustments

• publish-release.yml triggers on push to 3.x, not main.
• script/release accepts both main and 3.x as valid release branches.
• The release PR base is derived from branch_name(), so the same script cuts main-targeted PRs on main and 3.x-targeted PRs on 3.x.
• script/publish only publishes gh-pages when run from main. gh-pages hosts a single docs site — publishing from 3.x would clobber the current 4.x docs. 3.x still gets tagged and released — just no gh-pages update. The gh release create and push_gem dispatch both still fire on 3.x.

Verification

• bash -n script/release and bash -n script/publish: syntax OK.
• sed for MAJOR/MINOR/PATCH verified against 3.x's version.rb (which has the extra puts line at the bottom).
• No remaining main references in the workflow YAML.
• docs/_data/library.yml exists on 3.x; contributors.yml will be created by sync_contributors.rb on first release run before git add.

Environments and secrets

For the workflows to work on 3.x, the same environment/secret configuration used on main is required:

• The release environment (used by push_gem.yml) must permit v* tag refs — already the case for main.
• GITHUB_TOKEN on the publish and release jobs already has the required contents: write.
• Trusted Publishing on RubyGems already targets this repo — no per-branch config needed.