refactor: share is-release-pr check between changelog updates and stale closer

[cryptodev-2s]

Explanation

Shares release PR detection between changelog updates and the stale release closer.

• Extracts .github/actions/is-release-pr (merge-base + MetaMask/action-is-release)
• update-changelogs and close-stale-release-prs both use it
• Stale closer still prefilters release/*, then only closes PRs confirmed as releases (root version bump + RELEASE_COMMIT_PREFIX)

Stacked on #9655 for review with @mcmire.

References

• Related to chore: auto-close stale release PRs after 3 hours of inactivity #9655
• chore: auto-close stale release PRs after 3 hours of inactivity #9655 (comment)

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Medium Risk
Changes release automation and which PRs can be auto-closed; mis-detection could close the wrong PR or miss stale ones, but logic is aligned with existing changelog release checks.

Overview
Centralizes release PR detection in a new composite action .github/actions/is-release-pr (PR metadata, checkout head, merge-base, MetaMask/action-is-release). update-changelogs drops its inline steps and calls this action instead, wiring job outputs from the action’s head-sha / merge-base outputs.

The stale release closer gains a two-stage pipeline: paginated listing of open same-repo release/* PRs, then a matrix job that runs the shared action and uploads confirmed PR numbers as artifacts. The close job only runs close-stale-release-prs.mts when that list is non-empty, passing RELEASE_PR_NUMBERS. The script no longer discovers release PRs by branch name alone—it fetches each listed PR and applies fork/skip-label guards before staleness close.

Docs (releasing.md) note that auto-close uses the same release check as changelogs, not only release/* branch naming.

^{Reviewed by Cursor Bugbot for commit 7c54446. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 869c4b3. Configure here.}