ci: deploy production only from release tags

[sammargolis]

Summary

• adds release workflow for tag-triggered production deployment (v*)
• builds image, pushes Artifact Registry, and deploys Cloud Run from release tag
• keeps production deployment in explicit release lane

Security impact

• reduces risk of accidental production deploys from non-release commits
• supports environment protection and controlled release gating

PHI handling impact

• no direct PHI handling code changes
• enforces safer release mechanism for hosted runtime containing PHI-processing routes

Tests executed

• workflow includes pnpm lint, pnpm typecheck, pnpm test:no-phi-logs before deploy

Rollback plan

• revert this PR to disable tag-based production deployment workflow