ci: auto GitHub Releases + parallel test scenarios

[PKramek]

Summary

Two CI improvements:

Auto-create GitHub Release after GHCR publish

• New create-release job runs after post-publish verification
• Uses gh release create --generate-notes for PR-based changelog
• Scopes notes to changes since the previous tag
• Uses env: block for github.ref_name (security best practice)

Split test-scenarios into 3 parallel groups (~60% faster)

The 17 scenarios are split by estimated build cost:

• fast (6 scenarios): default_options, completions_pipeline, mcp_enabled, negative_validation, security_permissions, completions_disabled
• medium (6 scenarios): custom_version, custom_install_path, custom_node_version, install_path_with_completions, mount_host_config, node_preinstalled
• slow (5 scenarios): idempotency, upgrade_version, multi_feature_combo, alpine_specific, fedora_default

Each group dynamically filters scenarios.json via jq at runtime — no file duplication. Expected wall-clock: ~3.5 min (down from ~8-10 min serial).

Test plan

• All 3 scenario groups pass (fast, medium, slow)
• All 8 image matrix jobs pass
• arm64 tests pass
• No scenarios silently dropped (all 17 present across groups)