Automate maintenance backport patch releases

Problem

With the shift away from pushing directly to the default branch, we need an automated, repeatable solution that could cut patch releases from maintenance lines without master access. The goal is to eliminate manual toil while ensuring deterministic changelogs, proper tag naming, clean conflict recovery, and an auditable workflow