BUILD-11464: Add update-release-channel manual-ops workflow

.github/workflows/release.yml

@@ -26,3 +26,16 @@ jobs:
       slackChannel: C02E6L5C01H # squad-devex-private
       skipJavascriptReleasabilityChecks: true
       createDraftRelease: false
+
+  update-stable-channel:
+    needs: release
+    if: ${{ !inputs.dryRun }}
+    runs-on: sonar-xs
+    permissions:
+      id-token: write # OIDC → Vault
+      contents: read
+    steps:
+      - uses: SonarSource/ci-github-actions/update-release-channel@master
+        with:
+          version: ${{ inputs.version }}
+          channel: stable

.github/workflows/update-release-channel.yml

@@ -0,0 +1,31 @@
+---
+name: Update release channel
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Version the channel should point at (e.g. 0.9.0.977).
+        required: true
+        type: string
+      channel:
+        description: Release channel to update.
+        required: true
+        type: choice
+        options:
+          - latest
+          - stable
+          - dogfood
+
+jobs:
+  update-channel:
+    runs-on: sonar-xs
+    environment: release-channel-admin
+    permissions:
+      id-token: write # OIDC → Vault
+      contents: read
+    steps:
+      - uses: SonarSource/ci-github-actions/update-release-channel@master
+        with:
+          version: ${{ inputs.version }}
+          channel: ${{ inputs.channel }}