Run full-tree CI verification on release PRs instead of changed-only scope

### Problem

Every verification job in `.github/workflows/ci.yml` scopes its work with `pants --changed-since=$BASE_REF`. A release PR is produced by `scripts/release.sh` on a `release/` branch and touches only VERSION, CHANGELOG.md, consumed `changes/*.md` fragments, generated sample configs and API docs, vendored binaries, and WebUI static assets. It contains no Python sources, so pants selects zero targets and every test job reports success without executing a single test.

Observed on PR #13826 (release: 26.4.10): test-unit, test-component and test-integration all finished green, with the pants counters reporting `local_execution_requests: 0`. A green release PR therefore carries no signal about the release contents.

### Current behavior

- check-build-and-lint: `pants tailor --check update-build-files --check '::'` runs full-tree only for tag pushes, while `pants lint` always uses `--changed-since`.
- typecheck: `pants check --changed-since=$BASE_REF --changed-dependents=transitive` with no full-tree branch at all.
- test-unit / test-component / test-integration: the full suite runs only when `GITHUB_EVENT_NAME == push` and `GITHUB_REF == refs/tags/*`.

### Proposal

Treat a release PR as a full-verification trigger, in addition to the existing tag-push condition.

- Detect release PRs by head branch prefix (`github.head_ref` starting with `release/`), matching the branch name `scripts/release.sh` creates.
- Expose the flag once (e.g. as a `detect-changes` job output or a shared env var) so all verification jobs share a single definition instead of repeating the condition.
- When the flag is set, take the full-tree branch in each step: `pants lint '::'`, `pants check '::'`, and `pants test tests/{unit,component,integration}/::` keeping the existing shard matrix.

### Acceptance criteria

- A PR whose head branch matches `release/*` runs lint, typecheck, and all three test suites over the whole tree.
- Non-release PRs keep the current changed-only scope, so ordinary PR CI time does not regress.
- Tag-push behavior is unchanged.
- Confirmed on the next release PR that the test jobs actually execute tests rather than selecting zero targets.

### Notes

Full integration and component suites make release PR CI noticeably slower, which is acceptable because release PRs are rare and are the last gate before a tag is cut.

JIRA Issue: BA-7396

Read .github/workflows/ci.yml and scripts/release.sh first, tracing the existing tag-push conditions, changed-only Pants commands, and test shard matrix. Verify the release branch prefix used by the script and identify how one shared full-verification flag can reach every verification job. Done means release/* pull requests run full lint, typecheck, and unit/component/integration suites, while ordinary PRs and tag pushes retain their current behavior.

Written by the indexing model from the issue text.