[Eduardo Villalpando Mello (edvilme)]

Summary

Follow-up to #26282. Adds only .github/workflows/release-pr-release.yml; the separate read-only Release PR / Plan workflow is unchanged. Keeping the release trigger separate also avoids overlapping the plan-adoption PR.

• Handles only pull_request_target: closed events targeting main, and runs only when the PR was merged. Closing an unmerged PR does not run the release job.
• Calls microsoft/vscode-python-ci/actions/release-pr@4e0c4335bbf6b1a274673e22d9c39cd7efb93ccf with mode: release and the default release/ prefix. Only this dedicated job receives contents: write; no custom token or additional checkout is added.
• Revalidates the exact merged change and the PR creator's current write/maintain/admin permission. Only root-package.json-only, top-level-version-only valid bumps qualify. Ordinary PRs skip successfully. Creates release/<calculated-stable-version> without pushing to main or updating an existing release branch; retries fail if the branch already exists.
• Uses the trusted target-branch workflow and pinned action; no checked-out PR scripts or hooks are executed. Reports either the created branch/stable version or that no release candidate was found.

Activation and prerequisites

Merging this PR enables release-branch creation on subsequent qualifying merges. The existing Azure stable pipeline matches release/* and defaults publishExtension to true, so branch creation can publish an extension. This does not change Azure YAML, publishing approvals, credentials, or branch protection.

• Merge prerequisite Add read-only release PR validation #26282 first. It is still open; do not approve activation before its read-only plan check is available.
• Before approving activation, configure/confirm Release PR / Plan as a required check and confirm the Actions bot can create release/* refs.
• Confirm the intended Azure pipeline is enabled, its UI trigger overrides match the checked-in YAML, and publishing permissions/approvals are ready. Only checked-in configuration was inspected; live publishing was not exercised.
• Prefer observing the Black Formatter pilot before approving the remaining repositories. No release branches were created as part of this PR.

Python's Azure publishing prerequisite #26277 is merged. This workflow-only maintenance PR uses the existing skip-issue-check label; there is no separate product issue.

Validation

• Prettier, whitespace checks, and actionlint v1.7.7 pass for the new workflow.
• Local workflow contract checks cover the main/closed event filter, merged-only guard, dedicated write permission, reviewed action pin, and single-file scope. Bash syntax and both job-summary outcomes pass.
• The exact pinned shared action passes all 22 tests: 15 release-action tests and 7 version-action tests, including authorization/API failures, unchanged-version skips, stable serialization, and existing-branch rejection.
• The release workflow cannot be exercised on an open PR: it uses the trusted target-branch workflow after merge. No live release/publish smoke test is claimed. Where the plan check is already present on main, this workflow-only PR should pass as not applicable.