ci: migrate to push-based release flow

[fiunchinho]

Summary

Migrates this repo from the legacy create_release_pr + create_release branch-name-trigger flow to the validated push-based auto-release flow used in muster (giantswarm/muster#792) and klausctl (giantswarm/klausctl#259).

After this lands, normal feature merges to main automatically tag and publish a GitHub Release with notes generated from conventional commits since the last tag. No release PR, no main#release#minor branch dance, no manual CHANGELOG.md edits required for the release itself.

What's added

• .github/workflows/auto-release.yaml — single Tag job. On push to main / release-*: git-cliff walks unreleased conventional commits, computes the bumped version, and gh release create --target $GITHUB_SHA creates the tag + GitHub Release atomically. Concurrency-grouped per branch so backport releases on release-* don't fight with main.
• cliff.toml — bump rules (feat -> minor, feat! / BREAKING CHANGE -> major, otherwise patch), Keep-a-Changelog group mapping (feat -> Added, fix -> Fixed, refactor/perf/docs/chore/test/build/ci -> Changed, security -> Security), squash-merge (#N) preprocessor, and [remote.github] for PR-link rendering.

What's removed

• .github/workflows/zz_generated.create_release_pr.yaml — legacy release-PR opener (the main#release#patch branch trigger). Replaced.
• .github/workflows/zz_generated.create_release.yaml — legacy tag/release publisher invoked by the release branch flow. Replaced.
• .github/workflows/zz_generated.validate_changelog.yaml — enforced that every PR update CHANGELOG.md. Incompatible with conventional-commit-driven generation where release notes come from commits, not handwritten file edits.

What's preserved

• CHANGELOG.md — left untouched. Existing entries stay as historical record; future release notes are published only on the GitHub Releases page. The [Unreleased] section is currently empty so nothing is lost.
• zz_generated.semantic_pull_request.yaml — essential for the new flow (enforces conventional-commit titles on PRs).
• zz_generated.check_values_schema.yaml, zz_generated.gitleaks.yaml, zz_generated.run_ossf_scorecard.yaml, zz_generated.add-team-labels.yaml, zz_generated.add-to-project-board.yaml — unrelated, kept.
• .circleci/config.yml — chart publish on /^v.*/ tag filter. Unchanged; it still fires on the tag the new workflow creates.

Repo-specific notes

This is a Helm chart umbrella (agentic-platform + agentic-platform-crds, no Go code), so:

• No architectures override on CircleCI (no CLI binaries).
• No upload-release-assets job needed (no binary artifacts).
• The CircleCI tag-filter (tags: only: /^v.*/) is unchanged and picks up the new flow's tags automatically.

Test plan

• CI green on this PR (lint workflows only — there is no test suite to fail on this change)
• After merge: next conventional commit on main -> Auto-release workflow runs -> new v0.X.Y tag + GitHub Release created with notes generated from commits since v0.5.0
• Tag push triggers the existing CircleCI package-and-push-chart-on-tag workflow, which publishes both charts to the giantswarm catalog as before