Consider switching evergreen tag-promotion from manual kickoff back to a daily cron (once cluster reconciler crons are trusted)

Idea

The floating evergreen track tags (latest/standard/trailing) are advanced by a manual-kickoff action (.github/workflows/cicd_evergreen-tracks-promote.yml, workflow_dispatch-only). Once we trust the in-cluster reconciler CronJobs (biweekly, now armed per the infra epic), we could move standard/trailing promotion back to a daily cadence.

NOT a blind revert of #36652 — keep its improvements

#36652 ("manual-only standard/trailing promotion, drop daily cron") did two things: (a) dropped the daily schedule: cron, and (b) added genuine improvements we want to KEEP:

• plan → apply two-stage flow gated on the evergreen-tracks-apply required-reviewer environment (human reviews the dry-run before tags move).
• Regression test pinning --tracks latest so a release cut moves only latest, never standard/trailing.
• Refreshed cli.py/cicd_6-release.yml comments + README.

So this issue is re-add the daily schedule: trigger only, preserving the plan/apply structure, the isolation test, and the docs — a surgical change, not git revert #36652.

Design nuance to resolve

The apply job waits on a required-reviewer gate, so a cron-triggered run would still block for human approval — i.e. it wouldn't be truly unattended. Decide the cron path's interaction with that gate:

• Option A: cron runs plan-only (keeps manual apply) — daily visibility, human still approves moves.
• Option B: cron runs plan+apply unattended, bypassing/auto-approving the gate for the scheduled path — true daily promotion. Safe because the infra reconciler only rolls in-window, on-parity, with immutable @sha256 pins (this is why we can revisit unattended now).

Why safe now

The infra reconciler pins every roll to an immutable @sha256 digest and only acts in its biweekly maintenance window (parity gate + eligibility + no-downgrade). Daily source-tag promotion just keeps the floating tags fresh; it doesn't change rollout cadence or safety.

Gate

Only after the cluster reconciler crons have run armed for a cycle or two and are trusted.

Parent epic: #35693. Re-adds the cron dropped in #36652 (without reverting its other changes).