release: support beta channel publication

[mr-lee]

Accept exact vX.Y.Z-beta releases as non-latest prereleases and keep RELEASES.json stable-ring metadata isolated.

What does this PR do?

make the mirror channel-aware:

• Accept only X.Y.Z or X.Y.Z-beta, paired with full or beta.
• Stable releases remain normal/latest and update both stable and beta in RELEASES.json.
• Beta releases become prerelease/non-latest and update only beta, preserving stable.
• PR validation rejects malformed metadata, mismatched tags, timestamps, or beta versions in the stable channel.
• Publication is bound to the immutable release-ci-vX.Y.Z[-beta]- source tag, exact commit, receipts, assets, and release branch.
• Existing idempotency and asset-integrity checks apply equally to beta releases.