Draft: ci: add protected release deployment on Runner 22

Adds a protected release-branch pipeline using the existing release Shell Runner #22 (aicnc_release_aigc). Validation precedes manual deployment; host secrets, installed runtimes, models and job state are preserved, with code backups and service health checks. The existing AWS pipeline is preserved where present. Validation: 11 frontend tests and the production frontend build passed; Bash syntax, release YAML and real rsync fixture tests passed on Linux. Not merged or deployed. Enable shared runners for this project, create/protect release from the intended code revision, and review the scoped host write/restart permissions before enabling deployment. GitLab CI Lint and actual Runner job pickup still need verification. See ci/RELEASE.md.