ci: require releases to be tagged on a release/v* branch

[JosteinGj]

Releases are now cut from release branches rather than from main.

• release.yml: the versions job, which every publish job depends on, refuses a vX.Y.Z tag unless its commit is on release/vX.Y or release/vX.Y.Z. A tag on main alone, or on another minor line's branch, fails before anything is built or published. The tag format and manifest-version checks are unchanged.
• ci.yml: CI also runs on pushes to release/v*. PRs were already unfiltered, so PRs into a release branch were already checked.
• AGENTS.md: the release section describes the convention: one branch per minor line, and push the branch before the tag.

Testing

The new check only runs on tag pushes, so this PR's release rehearsal does not exercise it. I tested it against a scratch git repo:

Tag	Commit on	Result
v0.5.1	release/v0.5	passes
v0.5.1	main only	refused
v0.6.0	release/v0.5	refused
v0.5.10	release/v0.5	passes
v0.50.0	release/v0.5	refused (a shared prefix doesn't match)

Not covered

CI cannot stop someone from creating a v* tag; it only stops the tag from publishing. Restricting tag creation and protecting release/v* branches needs repository rulesets.

Docs

No datahub-sdk-docs pages are affected. This changes the release process, not the SDK's surface.

🤖 Generated with Claude Code