Separate release versioning from deployment

[anth-volk]

Fixes #2429

Summary

• keep validation and release-version generation in the push workflow
• pass the generated release commit SHA explicitly to a reusable deployment workflow
• prevent the generated commit from starting a redundant second push workflow
• apply deployment concurrency only to deployment work
• make deployment, migration, and database-seeding jobs use the same release commit

Validation

• actionlint 1.7.12 across all GitHub Actions workflows
• YAML parsing
• git diff --check
• changelog-fragment validation
• workflow job-inventory comparison

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 46.26%. Comparing base (37e168a) to head (2b5eed8).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3819   +/-   ##
=======================================
  Coverage   46.26%   46.26%           
=======================================
  Files         135      135           
  Lines        7963     7963           
  Branches     1326     1326           
=======================================
  Hits         3684     3684           
  Misses       3990     3990           
  Partials      289      289           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.