ci: add exact-head release PR auto-merge gate

[ankitTelnyx]

Summary

• add a trusted default-branch policy for generated Release Please PRs
• attest immutable PR identity, exact base/head/next trees, staging and SDK-config provenance, expected check producers, and live required contexts
• poll fail-closed, repeat the complete attestation immediately before mutation, and use a non-admin squash merge bound to the exact head SHA
• add a dry-run dispatch path and 21 behavior tests covering identity, tree/provenance drift, check retries, wrong-app checks, polling, race prevention, and merge readback

Security properties

• privileged job uses pull_request_target but checks out only the trusted default branch
• no pull-request-controlled code is executed
• SDK_WRITE_TOKEN is used only by the trusted gate's final normal merge command
• no --admin bypass; branch/ruleset protection remains authoritative
• Java is intentionally excluded pending DOT-2059

Validation

• 21 unit tests passed
• Python compile passed
• actionlint .github/workflows/release-pr-auto-merge.yml passed
• git diff --check passed
• live read-only dry run against release PR release: 4.174.0 #415 and exact head 7a575af35034704d60b6c51a1f052fdf0da408d9 returned ready without mutation

Rollout dependency

Merge team-telnyx/telnyx-python-staging#259 first so future promotions preserve these production-owned files.

Linear: DOT-2058