ci: automate paired local plugin releases after MemOS preparation

[MLittleprince]

Summary

This PR is intentionally stacked on #2243. Because #2243 comes from a fork, GitHub cannot use its head as this PR's base; until #2243 merges, the Files changed view temporarily includes that prerequisite commit. It keeps MemOS Release — Prepare as the trusted release-branch preparation step, then adds the post-merge MemOS/local-plugin release automation.

• automatically starts MemOS Release — Publish after an eligible same-repository release/vX.Y.Z, dev-vX.Y.Z, or dev-X.Y.Z PR is merged to main
• locks the release to the PR merge commit and validates both MemOS version declarations
• generates the whole-repository MemOS Release notes while extracting local-plugin evidence only from apps/memos-local-plugin/**
• releases a local-plugin patch only when the final evidence contains a real user-visible feature, fix, performance change, or impact-bearing refactor
• filters test/docs/version/build noise and removes reverted changes while retaining later genuine reapplications
• stages the MemOS and paired local-plugin tags/Draft Releases before any npm or docs side effect
• publishes and verifies npm only after a human publishes the MemOS Release, then publishes the paired local-plugin Draft so its release.published webhook is the sole docs trigger
• keeps the standalone local-plugin workflow for prerelease, major/minor, and urgent stable releases
• adds bounded retry, integrity, idempotency, recovery, source-ref, bilingual quality, and sensitive-data guards
• adds a Chinese operator/runbook document under .github/release-notes/

Safety boundaries

• Merging this PR does not trigger a release because its branch name is not an eligible release branch.
• Automatic post-merge releases always create Draft Releases first.
• npm, Plugin tab, pre, and gray do not start until a human publishes the MemOS Draft.
• Production publication remains manual.
• No token, endpoint, npm credential, or OSS credential is committed or written into artifacts.

Validation

• node --test .github/scripts/*.test.mjs: 155 passed
• node --test .github/scripts/prepare-memos-release.test.mjs: 64 passed
• workflow YAML parse: 4 passed
• bash -n .github/scripts/publish-local-plugin.sh: passed
• npm --prefix apps/memos-local-plugin run check:hermes-version: passed
• npm --prefix apps/memos-local-plugin run lint: passed
• focused Hermes version tests: 7 passed
• git diff --check: passed
• sensitive-value scan: no findings
• real-history dry run for MemOS 2.0.29: passed; it verified local-plugin baseline v2.0.15, detected three plugin-path changes as non-user-visible maintenance, skipped v2.0.16, and recorded no npm/docs/deployment side effects

Merge order

1. Review and merge feat: automate MemOS release preparation #2243 first.
2. Refresh this PR; GitHub will remove feat: automate MemOS release preparation #2243's prerequisite diff automatically.
3. Mark this PR ready, re-run required checks if necessary, and merge it.

This ordering keeps the preparation automation and paired local-plugin automation reviewable as separate changes.