ci(prod): dispatch domestic image promotion

[hongzexin]

Summary

• keep release builds in chekdata/multica and publish immutable GHCR images
• dispatch the completed release to the private ops-bootstrap promotion workflow
• stop writing GHCR image URLs directly into production manifests
• require manual releases to build from the company fork

Security and operations

• Volcengine credentials remain only in private ops-bootstrap
• ops-bootstrap validates the source commit is on chekdata/multica main
• domestic promotion verifies image fingerprints and rejects tag conflicts

Verification

• actionlint .github/workflows/chek-prod-release.yml
• ops-bootstrap v0.4.4 idempotency run: https://github.com/chekdata/ops-bootstrap/actions/runs/31806546088