Add fully local Incus image release pipeline

[Llewellynvdm]

What changed

• adds an executable scripts/local-image-release.sh orchestration command
• builds any selected image variants or all six sequentially
• validates repository and Incus/KVM preflight before building
• enforces VERSION and platform manifest agreement
• supports clean-checkout and protected-tag release gates
• packages and verifies every image locally
• optionally publishes verified packages directly to Gitea using runtime environment variables
• documents the behind-firewall local builder path and retains GitHub and Gitea Actions paths

Why

An in-house builder behind a firewall should not require GitHub to reach it. This path uses outbound-only connections and does not require a GitHub or Gitea Actions runner.

Validation

• branch is based directly on current master
• shell syntax and repository validation are exercised by the PR validation workflow
• full Incus VM builds require the trusted /dev/kvm builder and are intentionally left for the first hardware-backed run