chore(release): Add prepare release script

[mtodor]

Description

Adds a scripts/prepare-release.sh script that automates patch release preparation for existing Y-stream release branches. The script discovers the next Z version from git tags (e.g., if 0.2.1 exists, next is 0.2.2; if no tags exist, starts at X.Y.0), creates a release-X-Y-Z-prepare branch, bumps version and appVersion in charts/stackrox-mcp/Chart.yaml, and generates Konflux Release resource YAMLs for both stage and production environments.

Release resource files are generated from a single template (scripts/templates/release-resource.yaml) using yq path-targeted sub() substitutions with X.Y / X-Y / X.Y.Z / X-Y-Z placeholders. Output files are placed in releases/X.Y.Z/ at the repo root. The script does not commit or push — it prepares all changes for review.

Validation

• Run on a release branch with no existing tags — verify version resolves to X.Y.0
• Run on a release branch with existing tags — verify version increments correctly
• Verify Chart.yaml has correct version and appVersion after running
• Verify generated stage and prod Release YAML files have all placeholders replaced
• Verify snapshot field is WARNING-replace-before-create-WARNING
• Verify release.appstudio.openshift.io/author is set to current $USER
• Verify generateName follows the agentic-cluster-security-suite-X-Y--X-Y-Z--{stage|prod}- pattern

AI-assisted development prompts

This PR was developed with AI assistance. Below are the prompts used:

Prompt: "Create a new script which will prepare release for release branch. Script should take Y-stream version in X.Y format. Checkout release branch, discover next release version from tags, create release-X-Y-Z-prepare branch, change version and appVersion in Chart.yaml, create Release resource template from example file with proper version substitution, snapshot as WARNING placeholder, author as $USER. Create stage and prod files in releases/X.Y.Z directory. No commit or push."
Response: Explored the Release template structure and Chart.yaml, asked clarifying questions about prod variant (same structure, different names), tag format (X.Y.Z without v prefix), and snapshot handling (WARNING placeholder in template). Created scripts/templates/release-resource.yaml template and scripts/prepare-release.sh with targeted yq path-based substitutions after discovering that recursive .. selector corrupts files.

[github-actions]

E2E Test Results

Commit: 26bf622
Workflow Run: View Details
Artifacts: Download test results & logs

=== Evaluation Summary ===

  ✓ cve-cluster-list (assertions: 3/3)
  ✓ rhsa-not-supported (assertions: 2/2)
  ✓ list-clusters (assertions: 3/3)
  ✓ cve-detected-workloads (assertions: 3/3)
  ✓ cve-log4shell (assertions: 3/3)
  ✓ cve-detected-clusters (assertions: 3/3)
  ✓ cve-clusters-general (assertions: 3/3)
  ~ cve-nonexistent (assertions: 2/3)
      - MaxToolCalls: Too many tool calls: expected <= 5, got 10
  ✓ cve-cluster-does-not-exist (assertions: 3/3)
  ✓ cve-multiple (assertions: 3/3)
  ✓ cve-cluster-does-exist (assertions: 3/3)

Tasks:      11/11 passed (100.00%)
Assertions: 31/32 passed (96.88%)
Tokens:     ~56546 (estimate - excludes system prompt & cache)
MCP schemas: ~12562 (included in token total)
Agent used tokens:
  Input:  11995 tokens
  Output: 21511 tokens
Judge used tokens:
  Input:  84817 tokens
  Output: 74960 tokens

[codecov-commenter]

❌ 2 Tests Failed:

Tests completed	Failed	Passed	Skipped
380	2	378	12

View the full list of 2 ❄️ flaky test(s)

::policy 1

Flake rate in main: 100.00% (Passed 0 times, Failed 88 times)

Stack Traces | 0s run time

- test violation 1
- test violation 2
- test violation 3

::policy 4

Flake rate in main: 100.00% (Passed 0 times, Failed 88 times)

Stack Traces | 0s run time

- testing multiple alert violation messages 1
- testing multiple alert violation messages 2
- testing multiple alert violation messages 3

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[janisz]

Good structure — follows the same clean patterns as start-y-stream-release.sh. The regex escaping is consistently correct (all dots properly escaped), and the substitution ordering (X.Y.Z before X.Y) correctly avoids substring collisions. The WARNING-replace-before-create-WARNING snapshot placeholder is a nice safety mechanism. Two minor suggestions, no blocking issues.