ci: report published releases to CRM without depending on it

[cihanalagoz]

Summary

• Adds ci/notify-release-crm.sh, a byte-identical copy of the canonical CRM release notifier (kogniser-crm/release-ci/notify-release-crm.sh, contract v3) that Pulse, Studio and Console already use.
• Reports the published release to CRM as the last step of the publish job (target default, environment production).

The release never depends on CRM

• The step runs last, after publishing, with continue-on-error: true and a 3 minute timeout. Nothing in the workflow waits for CRM or reads from it.
• Missing secrets, an unreachable CRM or an unexpected answer only produce a warning. A CRM rejection fails only this reporting step, never the job.

Notes

• Uses the RELEASE_WEBHOOK_URL / RELEASE_WEBHOOK_SECRET organization secrets. If this repository cannot see them, the step warns and skips.
• Tags created before this change do not contain the script; re-running them skips the report without affecting the publish.

Testing

• actionlint and shellcheck on the new step
• The notifier was run locally against missing secrets, an unreachable endpoint and an HTTP 404: each one warned and exited 0.