Add a safe release path for Components 3.x maintenance fixes

[woksin]

Components 3.x is in maintenance/security-critical support until its end-of-life date is set, but there is no way to ship a 3.x patch without harming the 4.x line. #375 needs one: a 3.6.2 that narrows the PrimeReact peers to >=11.0.0 <11.2.0. A security fix would need one urgently, and the path should exist before that happens rather than being designed during an incident.

Constraints found while investigating #375:

• 3.x was released from main before 4.0. There is no 3.x branch; v3.6.1 is the latest 3.x tag.
• At v3.6.1, publish-version runs npm publish --provenance without --tag, so publishing 3.6.2 that way would move npm latest from 4.x to 3.6.2 for every consumer.
• cratis/release-action computes the next version from the repository's latest GitHub release or the highest version tag. A v3.6.2 GitHub release marked Latest would make the next 4.x release compute a 3.6.x version.
• npm trusted publishing is bound to the publishing workflow. A new workflow file or branch may need its own trusted-publisher entry, and nobody in this session has npm credentials to repair dist-tags by hand.

Done when:

• A support/3.x branch, cut from v3.6.1, can publish a 3.x patch with an explicit version, to a dedicated dist-tag (for example v3-lts), without creating a GitHub release marked Latest.
• The path is documented, with the recovery steps if a dist-tag goes wrong.
• A dry run shows that the next main release still computes its version from 4.x.
• components 3.6.1 build breaks with primereact/@primereact/styles 11.2.0 (password renamed to inputpassword) #375's peer-range fix is released through it.

[woksin]

Done. 3.x maintenance releases come from support/3.x: dispatch its publish.yml with gh workflow run publish.yml --ref support/3.x -f version=3.x.y.

• It publishes under the v3-lts dist-tag, then verifies that npm latest did not move.
• It pushes a plain git tag and creates no GitHub release.
• It skips packages already on the registry, so re-running a failed run continues it.
• main's publish workflow now refuses a version from an older major.

Proven with 3.6.2: all three jobs succeeded, latest is still 4.21.1 on both packages, v3-lts is 3.6.2, and a fresh install still resolves to 4.x. The procedure and recovery steps are in release.md (#380).