feat: train v2 - release direct to master

[vreshch]

Summary

Migrates the Friday minor-release train off the release-PR delivery pattern (branch -> PR -> auto-merge -> approve/poll) to direct-to-master ("v2-lite"). This broke 3 different ways in 3 weeks across the estate; the side-project trains that already push directly to master went 6/6 green.

Unchanged: cron slot, workflow_dispatch (no inputs), dependabot-quiescence wait, releasable-commit detection logic, minor-only bump (package.json + manifest.json + versions.json via npm version --no-git-tag-version minor), verify step, and the final dispatch of release.yml with build_current=true (same as before - release.yml itself tags the version already on master's manifest.json in build-current mode).

Replaced: release/<version> branch + PR create + auto-merge -> git pull --rebase origin master + git commit + git push origin HEAD:master (push failure is red, never forced). No tagging happens in train.yml here - that stays inside release.yml's build-current path, unchanged.

Added (fail-closed completion): the dispatched release.yml run is now polled to conclusion via gh run watch --exit-status, and the published GitHub release is asserted afterward (tag == manifest version, assets = main.js/manifest.json/styles.css present). Previously the train job went green the moment it dispatched release.yml, with no verification the publish actually succeeded.

The now-dead "skip if an open release PR exists" guard step is deleted.

Do NOT merge - draft for review. Do NOT dispatch the train from this PR.

Test plan

• python3 -c "import yaml; yaml.safe_load(...)" - YAML parses clean (no actionlint available locally)
• CI green on this PR (existing ci.yml/lint checks)
• Human review of the train.yml diff