chore(release): add snap-promote workflow for gated stable releases (#881)

* chore(release): add snap-promote workflow for gated stable releases

Issue #783 option 2 (safer): v* tags keep auto-publishing the snap to
edge + candidate in release.yml, and latest/stable is promoted by a
manual snap-promote.yml dispatch after candidate QA.

The dispatch resolves the revision on latest/candidate and refuses to
promote unless its version matches the tag, so a typo or stale candidate
fails the run instead of shipping the wrong revision. Declaring the
snap-stable environment with required reviewers adds an approval gate
on top of the dispatch.

Fixes #783

* fix(ci): serialize snap promotions and re-verify candidate

awk used the gawk-only \S which mawk reads literally, so the latest-track candidate row never matched. The promote step also trusted a revision resolved minutes earlier, letting an overlapping promotion downgrade stable. Serializes dispatches and re-resolves the candidate right before release.

---------

Co-authored-by: Jatin K Malik <jatinkrmalik@gmail.com>

docs/RELEASE_PROCESS.md

@@ -396,7 +396,9 @@ After pushing the tag, the GitHub Actions workflow will automatically:
 8. Deploy the website to vocalinux.com
 9. Build the amd64 snap, attach it to the GitHub Release, and try Snap Store
    `edge`/`candidate`. Store human review (for example `uinput` allow-installation)
-   must not block the GitHub `.snap`. `stable` is still a manual promote
+   must not block the GitHub `.snap`. `stable` does not auto-release (#783):
+   after candidate QA, dispatch `snap-promote.yml`, which releases the
+   candidate revision to `latest/stable`
 10. Mark as pre-release if version contains alpha/beta/rc
 
 Monitor at: https://github.com/VocaHQ/vocalinux/actions
@@ -409,6 +411,12 @@ Monitor at: https://github.com/VocaHQ/vocalinux/actions
       users to run `sha256sum -c` against it
 - [ ] If the Store held the snap for `uinput` review, confirm the GitHub `.snap`
       is still attached and the notes document `snap install --dangerous`
+- [ ] After candidate QA (install, tray, mic, model download, typing into a real
+      app), promote the snap to stable:
+      `gh workflow run snap-promote.yml -f tag=vX.Y.Z` - it fails unless
+      `latest/candidate` carries a revision whose version matches the tag. An
+      optional `snap-stable` environment with required reviewers adds a second
+      approval gate on the dispatch
 - [ ] Verify provenance: `gh attestation verify <artifact> --repo VocaHQ/vocalinux`
 - [ ] Verify PyPI package was published (if applicable), and that its wheel sha256
       matches the line for that wheel in `SHA256SUMS`