Pin release publishing workflows

[longlho]

Summary

• replace upstream release/publish reusable workflows with repo-local copies so transitive actions are pinned by SHA
• keep the release build on ubuntu-24.04-16core for the bazel test / cross-compile path
• keep publish-to-bcr behavior intact while pinning checkout, release upload, and publish-to-bcr actions

Validation

• ruby YAML parse for module_release.yaml and both local reusable workflows
• git diff --check
• custom check that every external uses: reference in the release path is SHA-pinned