Smooth release publish handoff

[eric-tramel]

What

Add an explicit PUBLISH=1 mode to make release so maintainers can run local release checks, create or reuse the plugin release tag, push the tag, and publish the GitHub Release in one command.

Also remove stale release-owner plumbing and documentation that still described the old email/CODEOWNERS gate.

Why

After the release workflow moved to GitHub Release events and Pages deployment moved behind the Documentation workflow, the remaining manual handoff was copying the generated tag into git push and gh release create. This keeps the safety checks while making the common authorized release path lower-touch.

Usage

Manual inspect-then-publish path still works:

make release PLUGIN=data-designer-my-plugin
git push origin data-designer-my-plugin/v0.2.0
gh release create data-designer-my-plugin/v0.2.0 \
  --title "data-designer-my-plugin v0.2.0" \
  --notes "Release data-designer-my-plugin v0.2.0" \
  --latest=false \
  --verify-tag

Lowest-touch authorized publish path:

make release PLUGIN=data-designer-my-plugin PUBLISH=1

How

• Add check-release-state so make release requires a clean worktree and a commit reachable from origin/main before tagging.
• Make release tag creation idempotent when the existing local tag already points at HEAD.
• When PUBLISH=1, push the tag and create the GitHub Release with --verify-tag.
• Delete the unused ddp.release_owners helper left over from the removed owner gate.
• Update README.md, docs/releasing.md, and AGENTS.md to match the current release contract.

Validation

• make -n release PLUGIN=data-designer-template
• make -n release PLUGIN=data-designer-template PUBLISH=1
• git diff --check
• make sync
• make check
• make docs
• make lint
• make test-devtools