feat(release): cut-rc — snapshot one-click rc release (#7447)

A `workflow_dispatch`-only lane that bumps the objectui pin, versions, gates
and publishes an rc from ONE snapshot, ending the two-repo pin-chasing freeze
dance (rc.6 needed four overtaken pin-bump laps and ~40 min of coordinated
freezes).

The snapshot is the whole idea: objectstack `main` and objectui `main` HEAD are
each resolved exactly once, and every downstream step reads those frozen values,
so both repositories may keep moving for the entire run.

Preserves every invariant of the existing lanes:
- 2026-08-07 manual-publish ruling: dispatch-only trigger, `environment: release`.
- #6170: the version commit lands on `main` FIRST and is published SECOND, so
  nothing is ever published from a ref that only existed inside the run.
- #3340: `check-objectui-pin-fresh.mjs` is unchanged and still enforces on the
  GA path. This lane asserts pin SELF-CONSISTENCY instead of liveness, because
  liveness is exactly what a snapshot gives up; the changeset record still
  covers OLD_PIN..SNAPSHOT by construction.
- #5960: the ADR-0082 D4 declaration-parity ratchet runs here, since this lane
  is now a route that moves the pin.

`release.yml`'s three lanes, `scripts/check-objectui-pin-fresh.mjs` and
`content/docs/releases/**` are untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BPWqbmEFU8gJepBJTHESXd

Author: claude