UID2-6762: Consolidate release-notes pipeline onto shared_create_releases

[jon8787]

Summary

Extend the shared_create_releases composite action to support all five publish platforms (Docker, Maven, PyPI, NuGet, iOS) and consolidate every inline mikepenz/release-changelog-builder step in the shared workflows onto the composite.

• One canonical release-notes pipeline lives in actions/shared_create_releases/action.yaml — Build Changelog → Delete Draft Releases → Create Release (draft).
• Each shared workflow now calls the composite via a single ~7-line step instead of duplicating ~30 lines of inline mikepenz / softprops / delete-draft logic.
• No mikepenz or softprops/action-gh-release references remain outside the composite.

Closes UID2-6762 (decision and rationale documented in the ticket comments: mikepenz over GitHub-native, primarily to suppress @AUTHOR from the public-facing release pages via pr_template).

Side-effect fixes (bugs found during the audit)

• PyPI template no longer emits a Maven <dependency> block — uses pip install <pkg>==<version> and links to the version-specific PyPI page.
• NuGet template no longer emits a Maven <dependency> block — uses dotnet add package and links to the version-specific NuGet page.
• Delete Draft Releases now runs for every platform (previously only shared-publish-java-to-docker-versioned had it).
• shared-publish-to-docker-versioned bumped composite reference from @v2 to @v3 for consistency with the rest of the repo.

Coordination with PR #228

PR #228 (UID2-6764, SLSA build provenance) touches shared-publish-java-to-docker-versioned.yaml just above this PR's edit area (adds an Attest build provenance step between Push to Docker and the release-notes block). No line conflict but I'll rebase this PR after #228 merges to preserve the attestation step. This PR should land after #228 and update-major-version-tags.yaml should be run on main immediately after merge to promote v3 — same post-merge requirement as #228.

Caller-repo impact

None directly. Consumers reference IABTechLab/uid2-shared-actions/.github/workflows/...@v3 (floating major tag) and will pick up the change automatically once v3 is re-promoted. The 6 ticket-scope repos (operator, core, admin, optout, databricks, snowflake) get verified opportunistically as Behnam's caller-repo follow-up PRs from #228 cut their next real publish.

Test plan

• YAML parses for all 7 touched files
• No mikepenz / softprops/action-gh-release / inline delete_draft_releases references remain outside the composite
• Rebase on main after PR UID2-6764: Add SLSA build provenance attestations to docker publish workflows #228 merges; preserve Behnam's Attest build provenance step in shared-publish-java-to-docker-versioned.yaml
• After merge: run update-major-version-tags.yaml on main to promote v3 (same post-merge requirement as PR UID2-6764: Add SLSA build provenance attestations to docker publish workflows #228)
• Verify release notes appear correctly on the next Patch publish in each of: uid2-operator, uid2-core, uid2-admin, uid2-optout, uid2-databricks, uid2-snowflake (Docker path); uid2-client-java (Maven); uid2-client-python (PyPI); uid2-client-net (NuGet); uid2-ios-sdk (iOS)

🤖 Generated with Claude Code

[BehnamMozafari]

I think env.REPO will pass uid2-client-python and shared_create_releases will run pip install uid2-client-python==<version> which will fail since the project is registered as uid2-client on PyPI

[jon8787]

Good catch — and the same pattern affects 4 of the Maven callers too (uid2-attestation-azure → attestation-azure, similar for -gcp, -aws, and uid2-client-java → uid2-client). 5 of 9 callers ship broken install snippets today.

Fixed in 31313d1 by extracting the real package identifier from the manifest at release time:

• PyPI: greps the top-level name = "..." from pyproject.toml
• Maven: uses mvn help:evaluate -Dexpression=project.artifactId -q -DforceStdout as the canonical source

Both fail loudly if extraction returns empty. NuGet stays hardcoded (workflow already only handles UID2.Client); Docker / iOS unaffected.

This also makes uid2-attestation-api and uid2-shared (currently correct by coincidence — repo name happens to equal artifactId) robust against future renames.