#128 ci: allow scoped maintenance releases

Summary

• keep stable releases restricted to main
• allow only vX.Y.Z-hotfixN prerelease tags from the matching release/vX.Y.Z branch
• reject all other feature-branch tags

Why

We need a minimal Kimi image-overflow patch from v0.1.13 without shipping the unrelated 958-commit v0.1.14 range. This preserves the existing release guard while adding an explicit maintenance path.

Validation

• checked workflow diff and shell/ref matching locally
• the maintenance release remains a prerelease, so it cannot replace /releases/latest

---

Summary by cubic

Allow scoped maintenance releases by permitting vX.Y.Z-hotfixN prerelease tags from release/vX.Y.Z while keeping stable releases restricted to main. Blocks feature-branch tags that could create divergent releases.

• New Features
  • Validate tags are on main or, for vX.Y.Z-hotfixN, on the matching release/vX.Y.Z.
  • Fetch main and release/* refs to check ancestry; reject others before uploads.
  • Hotfix releases remain prereleases, so /releases/latest is unchanged.