fix(ci): restrict promote tag release-* to version branches only

Root Cause

Commit 7cf5c8d072 (2026-07-28) added release-*) case to convert branch tags from release-X.Y → vX.Y. But the wildcard also matches deployment branches like release/el-salvador → vel-salvador, creating the wrong Docker tag.

Impact: release-el-salvador deployment tag was never updated — the service always pulled stale images. The fix in MR !262 (merged) existed in the code and was built correctly, but the promote step pushed it to vel-salvador (wrong tag) instead of release-el-salvador (correct tag).

Fix

- release-*) BRANCH_TAG="v${BRANCH_TAG#release-}" ;;
+ release-[0-9]*.[0-9]*) BRANCH_TAG="v${BRANCH_TAG#release-}" ;;

Semver pattern requires digits + dot (X.Y), with optional suffix (-rc1, -alpha):

Branch	Tag
release/2.0	v2.0 ✅
release/2.0-rc1	v2.0-rc1 ✅
release/el-salvador	release-el-salvador ✅
release/staging	release-staging ✅

Documentation

docs/RELEASE.md updated with strict branch naming rules (§2):

• Version branches: release/X.Y (digits only) → Docker tags vX.Y
• Deployment branches: release/<name> → Docker tags release-<name>