feat: rework release pipeline to use draft-release model (no manual tag push)

Problem

PAC is moving to the tektoncd GitHub org, which enforces branch protection rules. The current release process requires pushing tags directly (git push refs/tags/v1.2.3), which is blocked under these rules.

Current Flow

1. Engineer manually runs git tag v1.2.3 && git push refs/tags/v1.2.3
2. .tekton/release-pipeline.yaml triggers on push to refs/tags/*
3. Pipeline reads version from git tag --points-at HEAD
4. GoReleaser runs with prerelease: true (.goreleaser.yml:52) — creates a pre-release; tag must already exist

Problems:

• Direct tag push is incompatible with branch protection in the tektoncd org
• prerelease: true creates a pre-release rather than a draft, requiring an already-existing tag
• No way to trigger the pipeline without a pre-existing tag

Proposed Flow (tektoncd upstream pattern)

This mirrors the approach used by tektoncd/pipeline:

1. Trigger release via workflow_dispatch (or PAC push to a special branch) with a version input parameter
2. Pipeline builds binaries, generates manifests, and creates a GitHub draft release (no tag created yet)
3. Engineer reviews the draft, edits release notes, then publishes → GitHub automatically creates the tag on publish
4. Branch pushes (release-v1.2.x / stable) continue as today

Files to Change

References

• tektoncd/pipeline release-cheat-sheet and tekton/README for the upstream pattern
• GitHub docs: Automatically created releases — publishing a draft auto-creates the tag

Acceptance Criteria

• Release pipeline triggers via workflow_dispatch with a version parameter (no manual tag push required)
• GoReleaser creates a draft release (not a pre-release)
• Publishing the draft on GitHub creates the tag automatically
• Release process docs updated to reflect new flow
• Works within tektoncd org branch protection rules

Start with .tekton/release-pipeline.yaml and .goreleaser.yml at line 52, then compare the referenced tektoncd/pipeline release pattern. Update docs/content/docs/dev/release-process.md alongside the pipeline and GoReleaser changes. Done means workflow_dispatch accepts a version, creates a draft release without a manual tag push, publishing creates the tag, and branch-protection constraints are supported.