Integrate AR exit gate promotion step into nomulus release

[jicelhay]

We will push nomulus and proxy images to a new staging AR repo and call promoteArtifact to move them to the existing gcr.io repo. This should check build provenance against existing BCID for software policies that are in place for the images and attach relevant VSAs.

This refactors the release job config a little bit:

• we move image promotion and binauthz signing into a separate promote_artifacts script.
• we move the clod deploy release step to the parent job so it triggers only after the images are promoted.
• the specific job config for nomulus and proxy now only push images to a staging ar repo.

The rest of the release process remains unchanged. More details in go/domain-registry-bcid-gke and b/555750209

---

This change is 

[gbrodman]

@gbrodman reviewed 4 files and all commit messages, and made 4 comments.
Reviewable status: all files reviewed, 4 unresolved discussions (waiting on jicelhay).

---

release/promote_artifacts.sh line 67 at r1 (raw file):

  local operation_name
  operation_name=$(echo "${operation_json}" | python3 -c "import sys, json; d=json.load(sys.stdin); sys.exit(f'ERROR: {d[\"error\"]}') if 'error' in d else print(d.get('name', ''))")
  if [[ $? -ne 0 || -z "${operation_name}" ]]; then

we already set -e right? so this line cannot hit. Maybe worth printing the failure / input in the Python code in that case?

---

release/promote_artifacts.sh line 91 at r1 (raw file):

    if [[ -z "${status_json}" ]]; then
      echo "Warning: Failed to query operation status; retrying in 5s..."

if this happens, can we print the result of the gcloud operation for debugging purposes?

---

release/promote_artifacts.sh line 113 at r1 (raw file):

      echo "Operation in progress... (attempt ${attempt}/${max_attempts}), retrying in 5s..."
      sleep 5
    fi

maybe add an additional catch-all block for unknown "result" values, and maybe have the sleep after the "fi" so it happens on in_progress, retry, or unknown

---

release/promote_artifacts.sh line 143 at r1 (raw file):

  echo "nomulus digest: ${nomulus_digest}"
  echo "proxy digest:   ${proxy_digest}"

why are we doing both nomulus and proxy deployment when the release type is "nomulus"? I think currently we don't release the proxy during the normal weekly release process currently. Maybe we call it "all" if we're doing both?