Create Release-Specialist Bedrock agent with R/Y/G rubric

[gaiksaya]

Is your feature request related to a problem? Please describe

There is no interpretive layer that aggregates per-criterion release state into a holistic "is this release ready?" signal. The release manager must mentally synthesize 12+ criteria across two products to form a judgment. There's also no structured way to capture the Go/No-Go decision with an audit trail.

Describe the solution you'd like

Create a new Release-Specialist agent in agents/release/ following the OscarAgent base-class pattern:

Actions:

• get_release_status(version) — reads state from opensearch_release_state, applies R/Y/G rubric, returns verdict + reasoning
• get_release_window(version) — returns dates, days remaining, cadence phase from opensearch_release_schedule
• record_release_decision(version, decision, notes) — triggers Jenkins with decision payload (2PR enforced)

Rubric (config-driven):

• blocking (security_reviews, integ_tests, perf_tests) → Red if unmet
• standard (notes, docs, coverage, ticket, blog) → Yellow if unmet
• soft (sanity, roadmap) → noted only

Wiring:

• Collaborator on both supervisors (reads available to all; decision capture requires privileged)
• IAM: read-only es:ESHttpGet on the cluster
• Index routing for both new indices

Describe alternatives you've considered

• Pure LLM judgment (no config-driven rubric) — rejected for lack of determinism/auditability.
• Adding release logic to the existing metrics agent — rejected because release state is a distinct domain with its own rubric, cadence, and decision-capture flow.

Acceptance Criteria

• "What's the release state for 3.8.0?" returns correct R/Y/G verdict with per-criterion breakdown in Slack
• Verdict logic is deterministic: same state always produces same color
• Agent explains which criteria drove the verdict and what would flip the color
• record_release_decision triggers confirmation → Jenkins job fires → decision doc indexed + issue comment posted
• 2PR enforced: self-approval rejected with security error
• cdk synth succeeds with the new agent included