Update release manifest + QA

[jhchabran]

Add the final layer of paint + QA (internal+promotion).

I reworked how we handle branches, so we have the simplest and safest approach for the next few release cycles:

• creating an internal release:
  • <any branch> -> internal/release-vX.Y.Z
  • opens a PR (ex: (internal) release_patch: build v5.3.666 #1019)
  • CI build
  • once it reaches the finalization step in CI, it posts a message in the PR indicating that it's ready for promotion.
• promoting a release:
  • internal/release-vX.Y.Z -> promote/release-vX.Y.Z
  • opens a PR (ex: (promote) release: build v5.3.666 #1020)
  • CI build
  • once it reaches the finalization step in CI:
    • create a branch from promote/release-vX.Y.Z to release-vX.Y.Z
    • it posts a message in the PR indicating that it's been publicly released and that PRs can be safely closed (on both the promotion PR and the public one)
    • tags the commit from the release-vX.Y.Z branch.

The previous flow was:

• from any branch, sg release create ... would checkout a new branch named wip_vX.Y.Z
• a PR is created, trigger a CI run for the internal release.
  • at the very end of the run, the finalize step would create a new branch named wip-release-vX.Y.Z
• from any branch sg release promote-to-public would checkout a new branch named promote-release_vX.Y.Z
  • a PR is created, targeting wip-release-vX.Y.Z as the base branch, triggering a CI build for the promotion
    • there was a bug, you could end up accidentally creating a branch that can't be merged into that base. It works if you're running that command from the internal branch but may not otherwise.
    • at the very end of the run, the finalize step would tag the commit.

Problem: if you decide to merge the final branch that has the tagged commit, you'd end up with a dangling commit, which is risky/scary. This passed the review because back then we overlooked the fact that it's very to just close the PR, to keep things tidy.

Checklist

• Sister deploy-sourcegraph change:
• Sister customer-replica change (if necessary, for any changes affecting pure-docker or configuration):
• All images have a valid tag and SHA256 sum

Test plan

[jhchabran]

• 🟢 Release has been promoted, see tag: https://github.com/sourcegraph/deploy-sourcegraph-docker/tree/v5.3.0.
• 👌 You can safely close that PR and delete its a associated branch.
• ⚠️ Do not under any circumstance delete the branch holding the tagged commit (jh/qa/release)."

[jhchabran]

Needed to post on PRs. Tested in CI.

[BolajiOlajide]

What does =~ mean?

[jhchabran]

It's the regexp operator