ci: auto-backport workflow for release branches

Part of #715

Depends on the release branch model being adopted first.

### Problem

Once release branches exist, cherry-picking fixes from \`main\` to \`vX.Y-test\` is a manual process that is easy to forget or do incorrectly.

### Solution

Add a GitHub Actions workflow that auto-backports PRs to release branches when a specific label is applied.

### How it works

1. Maintainer merges a PR to \`main\`
2. Maintainer adds label \`backport-to-vX.Y\` (e.g. \`backport-to-v0.42\`)
3. Workflow triggers, cherry-picks the merge commit to \`vX.Y-test\`
4. If clean, opens a PR to \`vX.Y-test\` automatically
5. If conflicts, comments on the original PR asking for manual cherry-pick

### References

- Airflow's \`automatic-backport.yml\`
- [tibdex/backport](https://github.com/tibdex/backport) action

### Acceptance criteria

- [ ] Workflow triggers on label addition
- [ ] Creates backport PR automatically on clean cherry-pick
- [ ] Comments on original PR if conflicts arise
- [ ] Labels to be created: \`backport-to-vX.Y\` (one per active release series)