ci(workflows): redesign CI pipeline with quality gates and pre-release images

[r2dedios]

Summary

• Redesign validate-pr.yaml: lint, unit tests, and govulncheck now run in parallel, followed by integration tests, then container build validation (matrix, no push)
• Create release-images.yaml: builds and pushes pre-release images to Quay on every push to release-* branches, tagged as <branch>-<sha> (e.g., release-0.6-a1b2c3d)
• Rewrite build-container-images.yaml: triggers only on version tags (v*.*.*), publishes version tag + latest. Fixes the latest tag bug (was dead code). Removes the PR-to-main trigger that published images without quality gates
• All image build jobs now use matrix strategy (api, agent, scanner) instead of 3 duplicated jobs
• Add branching model documentation to CLAUDE.md

Test plan

• Create a PR targeting release-0.6 and verify validate-pr triggers with all jobs (lint, unit-tests, govulncheck in parallel → integration → build-check)
• Merge a PR into release-0.6 and verify release-images triggers with correct tag format
• Verify no workflow triggers for PRs targeting non-release/non-main branches