Release: make moving the latest Docker tag the default; require typed phrase to skip

Problem

cicd_6-release.yml gates the promote-latest job on a boolean update_latest checkbox. Even though it defaults to true, latest advancing depends on an operator not unchecking the box. Release 26.06.22-02 shipped with it unchecked, so latest silently stalled on 26.06.22-01 on both dotcms/dotcms and dotcms/dotcms-dev until manually corrected. Reliability of the default pull tag shouldn't depend on human memory.

Change

Replace the update_latest boolean with a free-text skip_latest field. latest moves on every GA release from main by default; skipping requires typing the exact phrase DO NOT UPDATE LATEST. Any other value (including blank or a typo) → latest updates (fail-safe toward the default).

Back-patches of older release lines remain safe without opting out: the evergreen-tracks engine is forward-only, so promote --tracks latest on an older release is a no-op (it only ever advances to the newest eligible GA). The deliberate runtime opt-out (hold latest via the admin workflow) is unchanged.

Start with cicd_6-release.yml and inspect the promote-latest job and its release inputs. Verify how the current update_latest checkbox controls promotion, then implement the exact skip phrase behavior so blank or invalid input still updates latest. Done means GA releases update latest by default, the exact opt-out skips it, and older release lines remain no-ops.