ci: add release workflows

[ovitrif]

Closes #1006
Related: #953
Replaces the release workflow portion of #959.

Description

This PR splits the release automation work out of #959:

• Adds manual release and release-internal GitHub Actions workflows for mainnet release artifacts.
• Uses GitHub environments for release secret access and keeps generated secret files out of the repo.
• Adds the checked-in debug Firebase placeholder so fresh clones can compile without private Firebase config.
• Moves CI/E2E/UI workflow debug Firebase decoding to ignored app/src/debug/google-services.json, which overrides the placeholder for debug variants.
• Lets GPR_USER / GPR_TOKEN override GitHub Packages credentials while still falling back to github.actor / github.token.

Preview

N/A

QA Notes

Manual workflow behavior should be verified in GitHub Actions (after merge).

Validated locally:

go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/release.yml .github/workflows/release-internal.yml .github/workflows/ci.yml .github/workflows/e2e.yml .github/workflows/e2e_migration.yml .github/workflows/ui-tests.yml
git diff --check
git check-ignore -v app/google-services.json app/src/debug/google-services.json app/src/mainnetRelease/google-services.json