ci: replicate source and release artifacts

[leandrodamascena]

Issue #, if available:

N/A

Description of changes:

• add an hourly and manually dispatched source replication workflow
• archive the exact master commit using git archive
• upload source and release artifacts with SHA-256 checksums and capture their S3 version IDs
• replicate signed release artifacts only after both smoke-test jobs succeed
• use pinned action SHAs, minimal job permissions, serialized execution, and a dedicated replication environment

Before merge, configure the replication environment for master and v* refs with these secrets:

• REPLICATION_ROLE_ARN
• REPLICATION_BUCKET_NAME
• REPLICATION_FUNCTION_ARN
• REPLICATION_REQUEST_CONFIG

Validation performed:

• parsed the modified workflows as YAML
• syntax-checked every shell block with bash -n
• verified deterministic source archives and absence of .git entries
• verified pinned action commit SHAs
• scanned the complete diff for credentials and internal identifiers

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[leandrodamascena]

Superseded by #227, which uses a branch hosted directly in this repository and contains source replication only.