ci: use dedicated runners for release publishing

## Description

Follow up on #2259. The release-publish workflow on `refactor` is now allowlisted for the `aws-release-4-core` runner group, but its `check-release` and `publish` jobs still request `ubuntu-latest`.

## Expected Change

- Move both jobs to `aws-release-4-core`, matching release preparation.
- Preserve the push trigger, release-PR checks, commit pinning, permissions, and verification matrix.
- Document that the publishing workflow's allowlist currently covers `refactor`, not `main`. After the file lands on `main`, its runner-group pin must be added before changing the branch filter.

This does not require publishing a package or dispatching a release for validation.

Start with the release-publish workflow and inspect its check-release and publish jobs, which currently request ubuntu-latest. Update both to the aws-release-4-core runner group while preserving the push trigger, release-PR checks, commit pinning, permissions, and verification matrix. Done means the workflow documents the refactor allowlist caveat and needs no package publishing or release dispatch for validation.

Written by the indexing model from the issue text.