feat: automate releases with Pipelines-as-Code

[vdemeester]

Changes

Automate CLI releases using Pipelines-as-Code (PAC), following the same
pattern established for tektoncd/pipeline and tektoncd/operator.

What's added

.tekton/release.yaml

PAC PipelineRun triggered via incoming webhooks. References the existing
tekton/release-pipeline.yml and catalog tasks (git-clone, golangci-lint,
golang-test, golang-build, goreleaser). The version tag is passed as the
revision so goreleaser can detect it.

.github/workflows/patch-release.yaml

GitHub Actions workflow with two trigger modes:

• Scheduled (weekly Thursday 10:00 UTC): scans all release-v* branches
  for unreleased commits since the last tag, creates version tags, and
  triggers PAC incoming webhooks
• Manual (workflow_dispatch): release a specific version on a specific
  branch

The workflow creates the git tag and pushes it before triggering PAC, since
goreleaser requires a tag on HEAD.

Dependencies

• feat: add PAC Repository CR for tektoncd/cli plumbing#3284 — Repository CR for tektoncd/cli
• tektoncd/infra#92 — release secrets in releases-cli namespace
• PAC_INCOMING_SECRET GitHub Actions secret on tektoncd/cli
• tekton-as-code GitHub App installed on tektoncd/cli

/kind feature

Submitter Checklist

• Includes tests (if functionality changed/added)
• Run the code checkers with make check
• Regenerate the manpages, docs and go formatting with make generated
• Commit messages follow commit message best practices

Release Notes

NONE

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please ask for approval from vdemeester after the PR has been reviewed.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment