feat(release): add targeted service scope

[pedrolupin]

Summary

• add an optional only input to chart release and force exactly the requested chart names
• make Docker release accept the same comma-separated selector, including all parity
• fail closed on invalid, blank, or unknown chart scopes
• document identical Docker/chart selector wiring for service-repository callers

This is the shared-workflow prerequisite for pinpredict/trading#2242. The trading caller change will pass its services input to both release workflows after this contract lands.

Verification

• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 -color
• exact chart prepare-step dry run: nadex-rfqgw selected only that chart
• exact chart prepare-step dry run: two-chart CSV selected only those charts
• invalid, unknown, and blank chart scopes failed closed
• all selected all 14 trading charts without publishing
• exact Docker args-step dry run: nadex-rfqgw produced only --only nadex-rfqgw
• exact Docker args-step dry run: all resolved to all 14 trading image ids