ci: NixOS release workflow — SD image + migration tarball (reinstate)

[mrosseel]

Reinstates the release workflow that was dropped when the nixos branch's CI was aligned to #493. It builds the SD image and the Debian→NixOS migration tarball (the migration target), neither of which is produced anywhere right now.

On release because workflow_dispatch only fires from the default branch (same rule as pull_request_target in #493/#495).

workflow_dispatch (maintainer-triggered, trusted context):

• builds the aarch64 closure, stable → pifinder-release (retained) / beta → pifinder (dev, transient — the beta→dev split);
• builds the SD image and the pifinder-migration-<tag>.tar.zst tarball;
• tags the source commit, creates the GitHub Release, writes the release entry to nixos-manifest.

Inert until the nixos flake config lands on release/main (it builds .#nixosConfigurations.pifinder + .#images.pifinder). Uses the manifest scripts already on release (from #495).

Note: softprops/action-gh-release@v1 carries an old-runtime actionlint warning — worth bumping to @v2.

🤖 Generated with Claude Code