feat: release candidate CI to allow for kokoro signing

[cabljac]

Implements a proper release candidate → final release workflow with signing integration points.

Key Changes

New RC Flow:

• create_rc=true → Creates RC with unsigned binaries (marked as prerelease)
• External signing process (Kokoro) replaces RC binaries with signed versions
• promote_rc=true → Validates signed binaries exist, then promotes to final release

Workflow Safety:

• Validates all expected signed binaries exist before promotion
• Prevents incomplete releases with clear error messages
• Only updates latest tag on final releases, not RCs

Process:

1. Build & test unsigned binaries
2. Create RC → upload unsigned binaries for testing
3. Kokoro signs macOS/Windows binaries, replaces in RC release
4. Promote RC → validates signatures, creates final release

[cabljac]

@pavelgj this is just an example, we could trigger kokoro automatically or some other flow

[Copilot]

Pull Request Overview

This PR implements a comprehensive release candidate workflow that enables proper binary signing integration with Kokoro for the Genkit CLI. The workflow creates a safe two-stage release process where unsigned binaries are first published as a release candidate, then signed externally, and finally promoted to a stable release.

Key Changes

• Added RC creation workflow that builds and publishes unsigned binaries for testing
• Implemented external signing simulation process with validation
• Created promotion workflow that validates signed binaries and creates final releases

Reviewed Changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 6 comments.

File	Description
.github/workflows/build-cli-binaries.yml	Enhanced to support RC creation with unsigned binaries and comprehensive testing
.github/workflows/sign-binaries-manual.yml	New workflow for manual binary signing simulation with validation
.github/workflows/promote-cli-release.yml	New workflow to promote signed RCs to final releases with safety checks
scripts/sign-and-upload-binaries.sh	Shell script that simulates the external signing process and uploads signed binaries