chore(build): host GDAL and hastegeo wheels on GitHub Releases

[jQuinRivero]

Summary

Moves the GDAL and hastegeo wheels from legacy Azure Blob hosting to the public haste-binaries GitHub Release, and adds an automated release-candidate pipeline for hastegeo changes.

For each hastelib release candidate, the pipeline produces one matching deployable set:

hastegeo-X.Y.ZrcN-py3-none-any.whl
hastetraining:X.Y.ZrcN
hasteimageryprep:X.Y.ZrcN

Changes

• Hosts GDAL and stable hastegeo wheels on GitHub Releases using anonymous public download URLs.
• Keeps local Function Docker builds on editable checked-out hastelib source.
• Makes the Hatch hook build-only; version resolution and publication are handled by tested CI scripts.
• Adds sequential PEP 440 RC versioning with patch/minor/major and exact-version overrides.
• Builds the RC wheel once in a read-only PR job.
• Publishes same-repository PR RC artifacts through a trusted default-branch workflow.
• Builds training and imageryprep images once in ACR, in parallel, using the exact wheel RC as both image tags.
• Prevents duplicate hastelib image builds in the existing Docker workflow.
• Defaults deployment image tags to the selected hastegeo version and rejects mismatched RC artifact sets.
• Prevents wheel and versioned image tags from being overwritten.
• Makes stable releases idempotent using source tags.
• Adds report-only scheduled RC cleanup with explicit retention support.
• Updates release, deployment, Docker, and contributor documentation.

Why

Previously, wheel building, publication, and dependency pin updates were coupled together. The initial CI design also built the same large Docker images locally and then rebuilt them in ACR, adding unnecessary wait time.

The new design separates untrusted PR builds from privileged publication while ensuring each expensive Docker image is built only once. The wheel and both images share one version, making the exact artifact set straightforward to deploy and reproduce.

Security properties

• PR build jobs use read-only repository permissions and no cloud credentials.
• Fork PRs cannot publish artifacts.
• Privileged publication uses workflow definitions from the default branch.
• Wheel filename and package metadata are validated before publication.
• Existing wheel names and mutable versioned image tags are rejected.
• Stable release publication remains separately gated.

Testing

• Release/version/publisher/workflow unit tests pass.
• Workflow YAML and action pin validation pass.
• Real RC wheel build and metadata validation pass.
• Function, training, and imageryprep Docker builds were smoke-tested.
• Public wheel URLs were tested from a clean Linux container.
• Standard repository security and code scanning checks run on the PR.

Rollout

The RC build and trusted publication workflows become active after these workflow definitions are available on the default branch. Stable publication remains disabled until the repository's release controls are configured.

Legacy Blob-hosted files are not removed, preserving compatibility for existing external pins during migration.