ci: prepare releases for Apache Trusted Releases

[tisonkun]

Summary

Configure Apache Trusted Releases (ATR) through .asf.yaml and make ATR the staging and publication path for new release candidates.

• Sync project metadata, source archive classification, email vote recipients, the 72-hour minimum, and the existing version-based download layout using the official project schema.
• Update the release skill for ATR uploads, artifact checks, pinned vote revisions, both Incubator vote rounds, publication, and retries. Preserve continuity for candidates already staged in SVN.
• Reuse the release manager's signing key and SVN-managed KEYS. Keep automated signing and GitHub OIDC upload onboarding in the optional infrastructure reference; crates.io Trusted Publishing remains configured separately.

Validation: cargo x lint, the official ASF project schema, skill validation, internal links, Markdown table alignment, and git diff --check pass.

This is a draft for the next release trial. After merging, verify the actual ATR synchronization, podling status, and signing-key import with an authenticated ASF account. Staging, voting, and publication have not been exercised against the live service.

Related to #303; automatic signing, weekly scheduling, and lifecycle automation remain follow-up work.