v3.2.0

ci: fix release.yml checkout ref + remove destructive post-steps

Port of the workflow hardening committed on the `beta` branch,
extended to also rewrite the stable release.yml. The previous
release.yml was inherited from upstream and:

- Checked out `github.event.repository.default_branch` (= `main`)
  instead of the tagged commit. A tag pushed from mariadb-patch
  therefore built from main's source tree, which did not contain any
  of the fork's work.

- Committed a version bump back to main via EndBug/add-and-commit.
  Main was supposed to be untouched on this fork; the bot commit
  landed there regardless.

- Ran EndBug/latest-tag, which moves a tag to point at the current
  checkout. Because the checkout had just gained a bot commit on
  main, the tag moved away from the real release commit to the main
  bump commit — pointing operators at the wrong source.

The fix:

release.yml:
- Checks out `${{ github.sha }}` — the tagged commit itself.
- Runs the full vitest suite against a compose MariaDB fixture
  before building, matching beta.yml.
- Drops the version-bump commit-back step. build.js still rewrites
  package.json.version from TGT_RELEASE_VERSION at build time, so
  the artefact advertises the tag correctly; the committed
  mariadb-patch version is bumped by hand as part of the release PR.
- Drops the EndBug/latest-tag step. Tags on this fork are owned by
  whoever pushes them; an automation should not rewrite tag targets.
- Adds the `!v*.*.*-*` exclusion so prerelease tags go to beta.yml.

beta.yml:
- Ported verbatim from the beta branch so tag cuts from mariadb-patch
  under a prerelease pattern (not recommended but not impossible)
  also work correctly.

pre-release.yml is deliberately left alone — it is workflow_dispatch
only, does not fire on tag pushes, and is superseded by beta.yml for
new work. A separate cleanup PR can retire it.