ci: add release candidate workflow

[intel352]

Summary

• adds a default-branch release-candidate workflow that validates an explicit candidate ref
• keeps candidate validation separate from semver publication so PR branches can be tested before merge/tag

Verification

• git diff --check

Note

This unblocks the network-audit evidence extraction plan: GitHub will not dispatch a workflow file that exists only on an unmerged PR branch.