Make release builds version-independent

[laurenspriem]

Summary

• replace the release-pinned versions.env with stable build policy in build.env
• split candidate construction from immutable publication using an exact successful build run ID
• resolve stable upstream tags to commits and verify candidate provenance, checksums, revision order, and tag availability
• update release documentation and remove the obsolete changelog and repackaging path

Validation

• actionlint
• ShellCheck and Bash syntax checks
• PowerShell parser checks
• JSON and whitespace validation
• live resolution of ONNX Runtime 1.28.1 to 5181af9bef60f46194ec30506855d74b6e6a96ff
• candidate provenance acceptance and rejection checks
• patch applicability and portable smoke build against ONNX Runtime 1.28.1

Native platform packages were not rebuilt locally; the candidate workflow performs those builds and runtime tests before publication.