feat(promote): [INFRA-692] add supersede-aware promotion workflow

[arrowplum]

Adds reusable_promote-release-bundle.yaml. Promotion into a stage that already holds a different version fails. Replacing it requires an explicit input and a reason, requires the gate owner, and is refused past STAGE.

Also fixes guard-promoted-beyond.sh, which read promotion records through jf rt curl on a /lifecycle/ path, received a 404, treated it as no promotions, and exited 0.

Jira: INFRA-692
Rules: promote-release-bundle/README.md

Changes

• reusable_promote-release-bundle.yaml and promote-release-bundle/entrypoint.sh: stage-order check, failure on an occupied stage, supersede input requiring supersede-reason, supersede refused at PREVIEW/INTERNAL/PROD, un-promote scoped to the target stage.
• gh-environment sets environment: on the promotion job. Required when supersede: true.
• Supersede written as bundle properties on both versions and to the run summary.
• bundle-revision on reusable_create-release-bundle.yaml and the create-release-bundle action, with a bundle-version output. Empty default preserves the current bundle version. auto gives <run_id>-<run_attempt>. Artifact versions unchanged.
• workflows/lib/jfrog-lifecycle.sh: Lifecycle API reads for both guards, failing closed. A never-promoted bundle answers 200 with an empty array.
• guard-promoted-beyond.sh rewritten on that lib.
• test_promote-release-bundle-workflow.yaml.

Before:

$ bash guard-promoted-beyond.sh ako-rerel-demo rev1 test
::warning::Promotion records endpoint returned 404; treating this as no existing promotion records.
exit=0

ako-rerel-demo/rev1 is promoted to TEST and STAGE.

Test plan

bats .github/workflows/promote-release-bundle/tests/bats/
bats .github/actions/delete-release-bundle/tests/bats/
bats .github/workflows/create-release-bundle/tests/bats/
.github/workflows/create-release-bundle/test-entrypoint.sh

test_promote-release-bundle-workflow.yaml runs those in CI and dry-runs the workflow against JFrog.