ci: use dedicated runners for release publishing #2267

Description

Follow up on #2259. The release-publish workflow on refactor is now allowlisted for the aws-release-4-core runner group, but its check-release and publish jobs still request ubuntu-latest.

Expected Change

• Move both jobs to aws-release-4-core, matching release preparation.
• Preserve the push trigger, release-PR checks, commit pinning, permissions, and verification matrix.
• Document that the publishing workflow's allowlist currently covers refactor, not main. After the file lands on main, its runner-group pin must be added before changing the branch filter.

This does not require publishing a package or dispatching a release for validation.