Refactor: unify the two theme release configs into the shared config/release.js factory

### Background

Release configuration currently lives in three places:

- `config/release.js` — a shared factory consumed by all 12 plugins (`releaseConfig({ name, phpFile, npmPublish })`).
- `themes/newspack-theme/.releaserc.js` — hand-rolled, covers the 6 classic theme variations.
- `themes/newspack-block-theme/release.config.js` — hand-rolled.

The two theme configs **don't use the factory** — they duplicate the entire skeleton: the `branches` array, the `plugins` chain (`commit-analyzer`, `release-notes-generator`, `@semantic-release/npm`, `semantic-release-version-bump`, and the `@semantic-release/github` block with the migration-era `successComment`/`releasedLabels`/`failComment`/`failTitle: false` flags), and the `prepare` ordering.

#179's predecessor PR (#186) already extracted the one piece that PR touched — the conditional `@semantic-release/git` commit step — into `config/release-helpers.js` (`gitCommitStep()`). That's "Layer A". This issue tracks "Layer B": folding the rest of the theme skeleton into the factory so there's a single source of truth.

### Proposal

Generalize `config/release.js` so themes can call it too, parameterizing the parts that genuinely differ:

| Aspect | plugins | newspack-theme | newspack-block-theme |
|---|---|---|---|
| version-bump `files` | `[ phpFile ]` | `newspack-*/sass/theme-description.scss` + `newspack-*/style.css` | `src/scss/_theme-description.scss`, `functions.php`, `style.css`, `style-rtl.css` |
| `gitCommitStep` assets | `[ phpFile, 'CHANGELOG.md' ]` | 6× `theme-description.scss` + `CHANGELOG.md` | `CHANGELOG.md`, `_theme-description.scss`, `functions.php` |
| GitHub `assets` (zips) | single `./release/.zip` | 6 theme zips | single zip |
| `npmPublish` | varies (only newspack-blocks publishes) | `false` | `false` |
| alpha channel | `prerelease: true` | `prerelease: true` | `prerelease: 'alpha'` ← one-off; reconcile or keep as a param |

A factory signature like `releaseConfig({ bumpFiles, gitAssets, githubAssets, npmPublish, alphaPrerelease })` collapses all three call sites to thin parameter objects.

### Why a separate PR

This touches the release path for **all 14 units** (12 plugins + 2 theme configs covering 7 themes), so it warrants its own change with a full sandbox matrix run (alpha / hotfix / release-promotion across every unit), independent of the narrowly-scoped hotfix-guard fix in #186.

### Notes

- Watch the block-theme `prerelease: 'alpha'` vs `prerelease: true` difference — decide whether that's intentional before unifying.
- The `@semantic-release/github` disabled-comment flags are migration-era (NPPM-2752 Phase 6); a unified factory is a good place to gate them in one spot when they're eventually re-enabled.

Follow-up to #186.

Start with config/release.js and config/release-helpers.js, then compare themes/newspack-theme/.releaserc.js with themes/newspack-block-theme/release.config.js. Map the duplicated plugins, assets, bump files, and prerelease behavior into the proposed factory parameters. Run the full sandbox matrix for alpha, hotfix, and release-promotion across all units; done means both theme configs are thin call sites with behavior preserved.

Written by the indexing model from the issue text.