ci: activate NixOS testable-PR builder on the default branch (release)

[mrosseel]

Why this is needed: nixos-pr-build.yml (the trusted, label-gated testable-PR builder) was merged to main in #493 — but it's a pull_request_target workflow, and GitHub only fires those from the repository's default branch. brickbots' default is release, which doesn't have the workflow (or .github/scripts/), so labeling a testable PR currently does nothing.

This adds exactly the three files from #493 to release (the rotated pifinder:Vkem… key included):

• .github/workflows/nixos-pr-build.yml
• .github/scripts/publish_manifest.sh
• .github/scripts/update_manifest.py

Once merged, a testable/preview label on a PR builds on the Pi5 → pushes the closure to the pifinder cache → writes the PR's entry to nixos-manifest, all in the trusted base-repo context.

Alternative to this PR: switch the repo's default branch to main (where the builder already lives, CI-aligned) — that's an admin setting and would make this PR unnecessary.

🤖 Generated with Claude Code